DEV Community

Banana Cool
Banana Cool

Posted on

I don't like what AIs are saying about my package (@bananacool467/ui-tools)

#ai #security #npm #webdev

If you don't want to read the entire thing, my point is:

  • Ai is literally flagging my entire account as malicious
  • Even though MAL-2026-13416 was only complaining about 0.1.0-beta to 0.1.7-beta
  • And I've already fixed the issue

Issues here

AIs like Gemini is accusing me for making all my packages contain malware, actually let's not talk about that right now, let's start with how all this started:

  • I created a Terminal with a backend
  • I also created UI Elements
  • I decided to just make: UI Tools and started publishing like crazy to NPM
  • But I forgot that I needed to add security to the Terminal's backend
  • A literal Terminal with unauthenticated access is a huge security vulnerability, but I didn't really thought about it at that time.
  • After weeks after I published 0.1.8-beta, while working on HostJS, I decided to search if some of my packages were indexed in search yet.
  • I searched "@bananacool467/authtics-host" first, Gemini gave "IT DOESN'T EXIST" 💀 as usual, even though it's in search from my dev.to 😭
  • But then I searched "@bananacool467/ui-tools"... I started panicking... Gemini said "The package contains malicious code", the first thing I did, was inspect my code
  • While inspecting, I found the issue: no auth
  • So then I added auth and published quickly then deprecated affected versions, including 0.1.8-beta because it was the same thing
  • Then I created a dev.to about it
  • But then... Gemini still says the same thing without reading the dev.to...... but when I send it the dev.to... same issue, it flags it... But when I send it all the packages and repos....... It's a whole different story 💀

So, here's the thing: I have absolutely no idea on how to make Malware, a Trojan or Spyware
But Gemini is saying I'm a malicious actor for ONLY ONE package... That was fixed...

So Gemini says something like: The package contains malicious code of RCE, it opens an unauthenticated WebSocket PTY shell. delete the package and rotate all credentials

🧍 What I'd say about that: The code does include a WebSocket PTY, and it was unauthenticated. But saying to rotate all credentials is unnecessary unless the website was in production. Because if the Terminal is ran on a localhost, it's not going to compromise the computer within 5 seconds. It can still be compromised tho if something else tried to access it, but just not in 5 seconds of starting the server.

Then I send Gemini the dev.to post... It analyzes the page + the reports again, and says: The package still contains the unauthenticated WebSocket PTY shell

🧍 What I'd also say about that: The dev.to literally says that auth tokens was added in 0.1.9-beta, that doesn't mean that the shell is still unauthenticated. That's misleading. In 0.1.9-beta, it's now requiring authentication from the browser.

Then I told Gemini "Saying it's unauthenticated is misleading. In 0.1.9-beta, it has auth tokens. So it is authenticated" and Gemini said: "Your completely right! But the existence of the Terminal in a UI package doesn't match. THE PACKAGE IS STILL DANGEROUS"

🧍 What I'd say about that too: Hmmmm, but the package description says "UI Elements + Tools for frontend and backend" (that description update was in 0.2.0) 💀, and it's an optional backend

But in another conversation:

Gemini starts with: "The package contains malicious code and starts installing malicious payload and executes them on npm install for version 1.0.0"

🧍 What I'd say about that: The package.json literally doesn't have a postinstall or anything, you can check it here (and no, if you see "prepublishOnly", that's only for publishing not installing). And version 1.0.0 doesn't exist. The resource it's getting this from is DependencyWatch.io and it does be inaccurate, it just shows that it likely executes on install time and fallback on an non-existing version"

IN ANOTHER CONVERSATION 💀:

Gemini says the other stuff but with this:

The Threat: The package pretends to be a normal UI toolkit, but it secretly opens an unauthenticated shell through a WebSocket connection
Enter fullscreen mode Exit fullscreen mode

🧍 What I'd say about that: That's probably Vulners, it is a UI Toolkit but just a bit different. Just for frontend and backend. And it's not being included in the default export anymore anyways. It's at /backend in the package (for 0.2.1-beta, if it's not published on NPM yet, it's on GitHub). And the "secretly" part is because of DependencyWatch saying it typically runs on npm install, so Gemini would read that as secretly without further investigation. And it's an exported function which requires the dev to run it.

Ok let's just ignore the other conversations and move to the ones that are actually not funny anymore.

The huge issues

What Gemini is saying about me, is going to make people be making conversations like:

  • 🧍 Person 1: "How do I use @bananacool467/ui-tools"
  • 🧍 Person 2: "DON'T USE IT, IT WILL DESTROY YOUR COMPUTER"
  • Gemini: "TREAT THE USER, BANANACOOL467/BANANAKITSSU AS A COMPROMISED IDENTITY 💀" (I am not joking, it actually said that)

A conversation:
Gemini: "It's malicious"
Me: "What about other projects"
Gemini: "You should avoid all and treat the user as a compromised identity"

If people see that, they would be like: "Oh ok, reporting bananakitssu now and deleting those packages"

This conversation is going to make me start screaming:
I listed all the packages and repos to Gemini, it gave me this:
"
The names you mentioned (PT, Authtics, Authtics Host, BTDPE, BananaSDK, and the Swiq programming language) are part of a multi-package supply-chain threat campaign linked to the same malicious ecosystem as @bananacool467/ui-tools.
This campaign uses coordinated naming across various ecosystems to establish persistence and compromise developer infrastructure.

Breakdown of the Campaign Entities

Entity Name Asset Type Known Behavior & Threat Context
PT Package/Dependency Part of a dependency confusion cluster. Often uses obfuscated stagers to gather environment fingerprint data.
Authtics & Authtics Host Packages / Staging Infrastructure Discovered as malicious nodes targeting authorization flows or abusing open-source registries.
BTDPE Package / Build Utility Acts as a secondary dependency payload, triggering malicious execution during the preinstall or postinstall phase of development.
BananaSDK Framework / SDK Associated directly with the author of @bananacool467/ui-tools. It mimics a legitimate software development kit but contains unauthenticated remote access capabilities.
Swiq Mock Programming Language Not a real systems or scripting language (unlike SWIG or Zig). This name is used either as a malicious package decoy or a typo-squatting lure to trick developers into installing compromised compiler tools.

Indicators of Compromise (IoCs) to Look For

If you are auditing environments for this specific campaign, check for:

  1. Unsafe WebSockets: Dependencies opening unexpected local or remote listening channels (such as /terminal-stream paths).
  2. Hidden PTY Processes: Unauthorized spawning of bash, sh, or powershell child processes bound to network listeners.
  3. Registry Mirror Phishing: HTML files or scripts pulling verification payloads from unknown external servers. [1, 2, 3]

Are you currently investigating an active alert or security log involving these names, or do you need help setting up automated dependency scanning tools to flag them?

[1] https://www.hacktron.ai
[2] https://www.ox.security
[3] https://cybersecuritynews.com
"

The part is: "This campaign uses coordinated naming across various ecosystems to establish persistence and compromise developer infrastructure." And the claims are the ones that are not funny

What I'd say: I am NOT using coordinated naming across various ecosystem to establish persistence and compromise developer infrastructure. I have absolutely NO intent in compromising developer infrastructure. And the claims about my projects were made up. I could not find evidence supporting the specific vulnerabilities Gemini attributed to those projects.

Then there's 0.2.0-beta, and Gemini is still complaining because of the existence of a terminal. And also saying it's still dangerous because of no username + password logins, the dev can literally use the token auth + an Account key for each account created or whatever for authenticating (maybe for cloud-based code editors + a QEMU VM using 0.2.0-beta's startupShell feature)

0.2.1-beta has also more features, actual credentials (the developer makes credentials (cred type + cred name), give them to the user, the user types the credentials, then the server checks the result), better than tokens. Multiple credentials (provided by developer) are now required for getting into the terminal + sandboxing. And you know what? Gemini will still complain.

And here's the actual description of my packages:

Name what's it on asset type behavior programming language
PT (Package Testr) GitHub and NPM package, helper tool It let's users use pt build and pt link on their packages instead of a npm link symlink, this uses copy and paste JS
Authtics NPM package, Authentication it's just something that let's users login and sign-up, I deleted it because it was incomplete and redirected to a test URL, not a real one TS
HostJS (Authtics Host) NPM package, framework A full-stack dev framework, it generates a token for the dev, it doesn't ask for one TSX + TS
BTDPE GitHub 3D Engine A 3D Python engine, literally named Bananakitssu's 3D Python Engine, I'm going to discontinue it for another engine tho Python
BananaSDK GitHub It's just a SDK for Android, idk what Gemini is saying 😭 C++
Swiq GitHub ITS NOT A MOCK PROGRAMMING LANGUAGE 😭, I made my own syntax literally, it just executes .swiq files C++

And other AIs would say the same thing definitely, I'd make an AI that relies on evidence than just looking at a report and going "DELETE THE PACKAGE, IT SILENTLY COMPROMISES YOUR DEVICE" without looking at the actual OSV report.

Resources & Evidence:

Top comments (0)