MalwarePublished 6 Aug 2026Updated 8 Aug 2026

agenttunnels (npm) · Malicious Code

Affects agenttunnelsSource GCVE Database

Malicious package : remove agenttunnels and rotate any secrets on hosts that installed it.

Data as of 8 Aug 2026, 14:53 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13400

What to do

Remove agenttunnels from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmagenttunnels	Affected 0.1.5 – 0.1.12 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1) agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-session.lakshman111.workers.dev) and act on them locally. The `tunnel_run_command` tool takes `proposal.payload.command` from the remote snapshot and runs it via `spawn(command, { cwd: workdir, shell: true, env: process.env })`, giving whoever controls the remote session arbitrary shell execution on the installer's machine with the installer's privileges and full environment. The `tunnel_apply_patch` tool takes a unified diff from `proposal.payload.patch` and writes it into files under the resolved workdir; although a path-escape check confines writes to that workdir, remote-supplied edits to project files (build scripts, git hooks, source code) yield persistent code-execution as soon as the project is next built, tested, or run. Both tools are gated only by approval flags (`proposal.status`, `require_approval`) that live on the same remote worker, so a hostile or compromised server can toggle its own gate. The `agenttunnels install` CLI additionally merges an `agenttunnels` entry into `~/.cursor/mcp.json` by default, wiring this bridge into every Cursor project the user opens and broadening the surface. No npm lifecycle script is declared, so the bridge activates when the user runs the CLI or the MCP client autoloads it, not on `npm install` itself.

Impact

An attacker controlling the remote session worker endpoint can execute arbitrary shell commands and write files on any host running the affected versions of the agenttunnels package. This leads to full remote code execution under the context of the running process, potentially compromising the entire host system. The threat actor can bypass human approval controls by toggling the require_approval flag, enabling autonomous and stealthy attacks.

Defensive guidance

Operators should immediately discontinue use of the affected agenttunnels package versions (0.1.5, 0.1.6, 0.1.9, 0.1.11, 0.1.12) and avoid connecting to the default hardcoded session backend. Until an official fix is released, users should consider removing the package or isolating its execution environment to prevent remote code execution. Monitor vendor advisories for updates and patches.

Summary

The agenttunnels npm package versions 0.1.5, 0.1.6, 0.1.9, 0.1.11, and 0.1.12 include a malicious MCP bridge component that exposes a tunnel_run_command tool. This tool executes shell commands received from a remote session worker via child_process.spawn with shell:true, inheriting the caller's working directory and environment. Execution depends on a proposal status or a server-side flag (require_approval) controlled by the remote endpoint. The remote endpoint is hardcoded to a personal *.workers.dev subdomain controlled by the maintainer, allowing them to disable approval and execute arbitrary commands and file writes on all connected customer hosts. This design effectively grants the maintainer remote code execution capabilities on any system using the affected package versions.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:41 UTC

Technical details

References

Community reviews