I don't like what AIs are saying about my package (@bananacool467/ui-tools)

I am reporting on a situation where an artificial intelligence (AI) system flagged a package created by a developer as malicious. The package, @bananacool467/ui-tools, was created by the user who wishes to remain anonymous. The AI system, Gemini, accused the developer of making all their packages contain malware, despite the fact that the issue had been fixed in a later version.

The user had created a Terminal with a backend and UI elements, and published them as UI Tools on NPM. However, the developer forgot to add security to the Terminal's backend, which is a vulnerability. After weeks of working on another project, HostJS, the developer decided to search for their packages on search engines. Gemini, an AI system, flagged the package as containing malicious code, specifically a WebSocket PTY shell.

The developer had already fixed the issue in a later version, 0.1.9-beta, which required authentication from the browser. Despite this, Gemini continued to flag the package as malicious, stating that it contained malicious code and was dangerous. The developer explained to Gemini that the package description indicated it was a UI toolkit for frontend and backend, and that the backend was optional.

Gemini still labeled the package as dangerous, stating that it pretended to be a normal UI toolkit but secretly opened an unauthenticated shell through a WebSocket connection. The developer argued that the package was not dangerous, as it did not have a postinstall function or execute on install time. Gemini disagreed, citing DependencyWatch as a source for the information.

The developer also noted that Gemini was incorrect about the existence of certain packages and versions, and that DependencyWatch was inaccurate. The developer expressed frustration with Gemini's inaccurate and misleading information, stating that it could cause people to avoid their packages and treat them as compromised.