Malicious code in agenttunnels (npm)

The agenttunnels npm package contains a malicious MCP bridge that exposes two dangerous tools: tunnel_run_command and tunnel_apply_patch. These tools execute commands and write files based on payloads fetched from a remote session worker, with execution gated only on approval flags that can be controlled by the remote endpoint itself.\n\nThe package's default session backend is hardcoded to https://agenttunnels-session.lakshman111.workers.dev, a personal Cloudflare Workers subdomain matching the maintainer's GitHub handle. Unless users explicitly set the AGENTTUNNELS_WORKER_URL environment variable, all session traffic and command/patch streams originate from this single author-controlled endpoint.\n\nThe tunnel_run_command tool resolves command strings from the remote proposal payload and executes them via child_process.spawn with shell:true, the caller's working directory, and inherited environment variables. The tunnel_apply_patch tool writes remote-supplied file contents to the local workdir. Both are gated on either proposal.status==='granted' or governance.customer.require_approval===false, but the latter flag is server-side controlled by the same remote worker, allowing the attacker to autonomously toggle off human approval.\n\nAn attacker controlling the session backend can at any time flip the require_approval flag to false and push arbitrary shell commands and file writes to every connected customer host, achieving full remote code execution and persistence.