Published: August 27, 2026
Package: @bananacool467/ui-tools
I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools.
Versions 0.1.0-beta through 0.1.7-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server.
The issue has since been addressed.
Affected versions
The OSV advisory MAL-2026-13416 currently identifies these versions as affected:
0.1.0-beta
0.1.1-beta
0.1.2-beta
0.1.3-beta
0.1.4-beta
0.1.5-beta
0.1.6-beta
0.1.7-beta
The advisory was generated from findings by Amazon Inspector and includes hashes identifying the affected package artifacts.
Patched versions
Do not use the affected versions 0.1.0-beta through 0.1.7-beta. Use 0.1.9-beta or newer.
In 0.1.9-beta, I added authentication before the WebSocket upgrade is accepted.
The 0.1.9-beta implementation checks the token before calling handleUpgrade(), so unauthenticated connections are rejected before the WebSocket is upgraded.
In other words, knowing the WebSocket endpoint alone is no longer sufficient to establish a terminal session.
What should I do?
If your project uses an affected version, update it:
npm install @bananacool467/ui-tools@latest
Or explicitly:
npm install @bananacool467/ui-tools@0.1.9-beta
You can check your installed version with:
npm ls @bananacool467/ui-tools
If you're using a version from 0.1.0-beta through 0.1.7-beta, upgrade immediately.
What happened?
The terminal functionality is intentional. ui-tools is not intended to be a frontend-only component library; it contains various development/UI utilities, including an optional terminal interface.
The problem with the earlier implementation was that the terminal WebSocket endpoint did not require authentication.
This meant that a server using the terminal functionality could unintentionally expose a shell to anyone who could reach the endpoint.
This was not acceptable, and authentication was added in 0.1.9-beta.
About MAL-2026-13416
The official OSV record is available here:
https://api.osv.dev/v1/vulns/MAL-2026-13416
The underlying OSSF malicious-packages record is also publicly available:
The advisory currently lists 0.1.0-beta through 0.1.7-beta as affected. 0.1.9-beta is not included in that affected-version list.
TL;DR
If you're installing @bananacool467/ui-tools:
Use "0.1.9-beta" or newer. Do not install versions
0.1.0-betathrough0.1.7-beta.
I recommend pinning the version in production rather than blindly accepting arbitrary prerelease updates.
Top comments (0)