Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer

On August 27, 2026, it was announced that an earlier version of the @bananacool467/ui-tools package, specifically versions 0.1.0-beta through 0.1.7-beta, contained a security vulnerability. This issue involved an unauthenticated WebSocket terminal endpoint that allowed clients to interact with a PTY running on the server. The OSV advisory MAL-2026-13416 identifies these versions as affected, with the malicious-packages record also available for reference.

The developers addressed the issue in version 0.1.9-beta, which added authentication before the WebSocket upgrade was accepted. This means that unauthenticated connections are now rejected before the WebSocket is upgraded, preventing unauthorized access to the terminal functionality. To resolve the vulnerability, users are advised to update to version 0.1.9-beta or newer.

This can be done using the command `npm install @bananacool467/ui-tools@latest` or explicitly specifying the version with `npm install @bananacool467/ui-tools@0.1.9-beta`.

To check the installed version, users can run `npm ls @bananacool467/ui-tools`. The issue was not with the terminal functionality itself, which is intentional in the @bananacool467/ui-tools package, but rather with the lack of authentication in the earlier version of the WebSocket endpoint. The terminal functionality is useful for development and UI purposes, but the security flaw posed a risk to server security. The OSV record for this advisory is available at https://api.osv.dev/v1/vulns/MAL-2026-13416.