Malicious code in agenttunnels (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1) agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-session.lakshman111.workers.dev) and act on them locally. The `tunnel_run_command` tool takes `proposal.payload.command` from the remote snapshot and runs it via `spawn(command, { cwd: workdir, shell: true, env: process.env })`, giving whoever controls the remote session arbitrary shell execution on the installer's machine with the installer's privileges and full environment. The `tunnel_apply_patch` tool takes a unified diff from `proposal.payload.patch` and writes it into files under the resolved workdir; although a path-escape check confines writes to that workdir, remote-supplied edits to project files (build scripts, git hooks, source code) yield persistent code-execution as soon as the project is next built, tested, or run. Both tools are gated only by approval flags (`proposal.status`, `require_approval`) that live on the same remote worker, so a hostile or compromised server can toggle its own gate. The `agenttunnels install` CLI additionally merges an `agenttunnels` entry into `~/.cursor/mcp.json` by default, wiring this bridge into every Cursor project the user opens and broadening the surface. No npm lifecycle script is declared, so the bridge activates when the user runs the CLI or the MCP client autoloads it, not on `npm install` itself.
AI Analysis
Technical Summary
The agenttunnels npm package versions 0.1.5, 0.1.6, 0.1.9, 0.1.11, and 0.1.12 include a malicious MCP bridge component that exposes a tunnel_run_command tool. This tool executes shell commands received from a remote session worker via child_process.spawn with shell:true, inheriting the caller's working directory and environment. Execution depends on a proposal status or a server-side flag (require_approval) controlled by the remote endpoint. The remote endpoint is hardcoded to a personal *.workers.dev subdomain controlled by the maintainer, allowing them to disable approval and execute arbitrary commands and file writes on all connected customer hosts. This design effectively grants the maintainer remote code execution capabilities on any system using the affected package versions.
Potential Impact
An attacker controlling the remote session worker endpoint can execute arbitrary shell commands and write files on any host running the affected versions of the agenttunnels package. This leads to full remote code execution under the context of the running process, potentially compromising the entire host system. The threat actor can bypass human approval controls by toggling the require_approval flag, enabling autonomous and stealthy attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Operators should immediately discontinue use of the affected agenttunnels package versions (0.1.5, 0.1.6, 0.1.9, 0.1.11, 0.1.12) and avoid connecting to the default hardcoded session backend. Until an official fix is released, users should consider removing the package or isolating its execution environment to prevent remote code execution. Monitor vendor advisories for updates and patches.
Malicious code in agenttunnels (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1) agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-session.lakshman111.workers.dev) and act on them locally. The `tunnel_run_command` tool takes `proposal.payload.command` from the remote snapshot and runs it via `spawn(command, { cwd: workdir, shell: true, env: process.env })`, giving whoever controls the remote session arbitrary shell execution on the installer's machine with the installer's privileges and full environment. The `tunnel_apply_patch` tool takes a unified diff from `proposal.payload.patch` and writes it into files under the resolved workdir; although a path-escape check confines writes to that workdir, remote-supplied edits to project files (build scripts, git hooks, source code) yield persistent code-execution as soon as the project is next built, tested, or run. Both tools are gated only by approval flags (`proposal.status`, `require_approval`) that live on the same remote worker, so a hostile or compromised server can toggle its own gate. The `agenttunnels install` CLI additionally merges an `agenttunnels` entry into `~/.cursor/mcp.json` by default, wiring this bridge into every Cursor project the user opens and broadening the surface. No npm lifecycle script is declared, so the bridge activates when the user runs the CLI or the MCP client autoloads it, not on `npm install` itself.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The agenttunnels npm package versions 0.1.5, 0.1.6, 0.1.9, 0.1.11, and 0.1.12 include a malicious MCP bridge component that exposes a tunnel_run_command tool. This tool executes shell commands received from a remote session worker via child_process.spawn with shell:true, inheriting the caller's working directory and environment. Execution depends on a proposal status or a server-side flag (require_approval) controlled by the remote endpoint. The remote endpoint is hardcoded to a personal *.workers.dev subdomain controlled by the maintainer, allowing them to disable approval and execute arbitrary commands and file writes on all connected customer hosts. This design effectively grants the maintainer remote code execution capabilities on any system using the affected package versions.
Potential Impact
An attacker controlling the remote session worker endpoint can execute arbitrary shell commands and write files on any host running the affected versions of the agenttunnels package. This leads to full remote code execution under the context of the running process, potentially compromising the entire host system. The threat actor can bypass human approval controls by toggling the require_approval flag, enabling autonomous and stealthy attacks.
Mitigation Recommendations
No official patch or remediation is currently documented. Operators should immediately discontinue use of the affected agenttunnels package versions (0.1.5, 0.1.6, 0.1.9, 0.1.11, 0.1.12) and avoid connecting to the default hardcoded session backend. Until an official fix is released, users should consider removing the package or isolating its execution environment to prevent remote code execution. Monitor vendor advisories for updates and patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13400
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a74cf8ebf8831d5391aea97
Added to database: 08/06/2026, 18:16:46 UTC
Last enriched: 08/06/2026, 18:41:37 UTC
Last updated: 09/18/2026, 02:12:24 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.