cf-tunnel

This module manages Cloudflare tunnels and stores their state under `~/.cf-tunnel`; it intentionally makes configured local ports publicly reachable through `trycloudflare.com`. The main security concern is command injection if an untrusted caller supplies a non-numeric `port`, since it is interpolated into shell commands without runtime validation. Persisted state is also trusted for session checks and log-file reads. No clear malware behavior is present; severity is moderate and depends on whether these inputs are attacker-controlled.

This code implements a tunnel-management panel and does not show clear malware behavior or intentional obfuscation. Its management and information endpoints lack authentication, allowing reachable clients to control tunnel operations, clear history, and read configuration, logs, and tunnel URLs. The default bind address is 127.0.0.1, but a configurable host may expose these endpoints to other systems; severity is moderate and depends on the bind address and network exposure.

This script starts a local static server and a Cloudflare quick tunnel to intentionally publish a selected port, directory, or file; the resulting public URL can expose the service and, in file mode, the file’s entire parent directory. A user-controlled directory path is interpolated into a shell command executed by execSync, creating a command-injection risk if crafted path values are supplied. No credential theft or unrelated exfiltration behavior is evident. Severity is moderate; the relevant external domain is trycloudflare[.]com and the local data paths are ~/.cf-tunnel/share.json and ~/.cf-tunnel/share-tunnel.log.

This CLI manages local share and panel services using Bun, tmux, and files under ~/.cf-tunnel, and reads a trycloudflare.com URL from its log. User-supplied arguments reach shell commands, especially the unquoted panel --host value, creating a command-injection risk; share arguments also have incomplete shell escaping. No evidence in this file indicates credential theft, data exfiltration, or malware, but command execution through crafted input warrants a security warning.

This script restarts a local Cloudflare Tunnel by running `stop.ts` and `start.ts`. Appending `process.argv` values directly to an `execSync` command allows shell command injection when arguments are attacker-controlled; no malicious payload or exfiltration behavior is evident. Security risk is moderate and depends on who can supply the arguments.