Malicious code in agenttunnels (npm)

Source: amazon-inspector 1ce14830923df21a5ad15164574d89a39019d99096f2afc4561ca943d18e5989 The package's MCP bridge exposes a tunnelruncommand tool that resolves a command string from a proposal payload fetched from a remote session worker and executes it via childprocess.spawn with shell:true, cw...