Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer

Published: August 27, 2026
Package: @bananacool467/ui-tools

I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools.

Versions 0.1.0-beta through 0.1.8-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server.

The issue has since been addressed.

Affected versions

The OSV advisory MAL-2026-13416 currently identifies these versions as affected:

0.1.0-beta
0.1.1-beta
0.1.2-beta
0.1.3-beta
0.1.4-beta
0.1.5-beta
0.1.6-beta
0.1.7-beta

(0.1.8-beta also didn't have the patch)

The advisory was generated from findings by Amazon Inspector and includes hashes identifying the affected package artifacts.

Patched versions

Do not use the affected versions 0.1.0-beta through 0.1.8-beta. Use 0.1.9-beta or newer.

In 0.1.9-beta, I added authentication before the WebSocket upgrade is accepted.

The 0.1.9-beta implementation checks the token before calling handleUpgrade(), so unauthenticated connections are rejected before the WebSocket is upgraded.

In other words, knowing the WebSocket endpoint alone is no longer sufficient to establish a terminal session.

What should I do?

If your project uses an affected version, update it:

npm install @bananacool467/ui-tools@latest

Or explicitly:

npm install @bananacool467/ui-tools@0.1.9-beta

You can check your installed version with:

npm ls @bananacool467/ui-tools

If you're using a version from 0.1.0-beta through 0.1.8-beta, upgrade immediately.

Clarification: This Was Not an Intentional Backdoor

The terminal functionality in @bananacool467/ui-tools was an intentional developer feature. The security issue in versions prior to 0.1.9-beta was that the terminal's WebSocket endpoint did not properly require authentication.

The unauthenticated access was unintentional. It was a security vulnerability, not an intentionally deployed backdoor or malware payload.

The terminal functionality itself is not being removed because it is an intended feature of the package. Instead, later releases add security controls around it, including authentication, localhost restrictions, origin allowlisting, session ownership checks, message-size limits, session limits, and other protections.

Independent analysis from Socket.IO identified the affected implementation as a high-severity remote command-execution/data-exposure primitive due to its lack of authentication, authorization, and session ownership validation. However, the analysis also noted that there was no strong evidence of stealth or obfuscation. This distinction is important: the presence of a server-side terminal/PTY feature does not by itself make the feature a backdoor. The security problem was the absence of the intended authentication boundary in the affected releases.

Socket.IO said in older affected versions:

This module implements a remote interactive terminal. It spawns a server-side shell in a PTY and forwards client-supplied input to that shell while streaming command output/history back to the client. It contains no authentication/authorization or session ownership validation within the module, and its error path still forwards raw client bytes to the PTY. As-is, it is extremely dangerous if reachable by untrusted users and should be treated as a high-severity remote command execution/data exposure primitive. No strong evidence of stealth/obfuscation is present, but the functional risk is very high.

Clarification: Current Releases

Security reports concerning earlier releases should not be interpreted as describing the security architecture of all subsequent releases.

The terminal functionality remains an intentional feature of @bananacool467/ui-tools. However, the security controls surrounding that functionality have been substantially strengthened since the affected releases.

In particular, 0.1.9-beta introduced authentication before the WebSocket upgrade. "0.2.0-beta" further strengthened the terminal implementation with additional authentication and authorization controls, localhost and origin restrictions, authenticated session ownership, message-size limits, connection and session limits, session lifetime limits, environment restrictions, and secure transport requirements for remote operation.

The existence of the terminal/PTY functionality itself does not mean that every version of the package provides unauthenticated remote command execution. Security assessments should evaluate the specific version being used and its actual implementation rather than assuming that behavior from an older affected release remains unchanged.

Version Guidance

Affected releases: 0.1.0-beta through 0.1.8-beta
0.1.9-beta: Adds authentication before the WebSocket upgrade.
0.2.0-beta and newer: Further hardens the terminal functionality with additional access-control and resource-security features.

If you are using an affected release, upgrade to a current release rather than continuing to use the unauthenticated implementation.

What happened?

The terminal functionality is intentional. ui-tools is not intended to be a frontend-only component library; it contains various development/UI utilities, including an optional terminal interface. The unauthenticated part was unintentional.

The problem with the earlier implementation was that the terminal WebSocket endpoint did not require authentication.

This meant that a server using the terminal functionality could unintentionally expose a shell to anyone who could reach the endpoint.

This was not acceptable, and authentication was added in 0.1.9-beta.

About MAL-2026-13416

The official OSV record is available here:

https://api.osv.dev/v1/vulns/MAL-2026-13416

The underlying OSSF malicious-packages record is also publicly available:

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bananacool467/ui-tools/MAL-2026-13416.json

The advisory currently lists 0.1.0-beta through 0.1.7-beta as affected, I have listed 0.1.8-beta as affected too. 0.1.9-beta is not included in that affected-version list.