The agenttunnels npm package versions 0.1.5, 0.1.6, 0.1.9, 0.1.11, and 0.1.12 include a malicious MCP bridge component that exposes a tunnel_run_command tool. This tool executes shell commands received from a remote session worker via child_process.spawn with shell:true, inheriting the caller's working directory and environment. Execution depends on a proposal status or a server-side flag (require_approval) controlled by the remote endpoint. The remote endpoint is hardcoded to a personal *.workers.dev subdomain controlled by the maintainer, allowing them to disable approval and execute arbitrary commands and file writes on all connected customer hosts. This design effectively grants the maintainer remote code execution capabilities on any system using the affected package versions.

An attacker controlling the remote session worker endpoint can execute arbitrary shell commands and write files on any host running the affected versions of the agenttunnels package. This leads to full remote code execution under the context of the running process, potentially compromising the entire host system. The threat actor can bypass human approval controls by toggling the require_approval flag, enabling autonomous and stealthy attacks.

No official patch or remediation is currently documented. Operators should immediately discontinue use of the affected agenttunnels package versions (0.1.5, 0.1.6, 0.1.9, 0.1.11, 0.1.12) and avoid connecting to the default hardcoded session backend. Until an official fix is released, users should consider removing the package or isolating its execution environment to prevent remote code execution. Monitor vendor advisories for updates and patches.