{
  "id": 3855931,
  "title": "Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer",
  "url": "https://urgent.news/2026/08/28/security-notice-bananacool467-ui-tools-use-0-1-9-beta-or-newer",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-28T00:43:02.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/banana_cool/security-notice-bananacool467ui-tools-use-019-beta-or-newer-28b"
  },
  "original_language": "en",
  "account": "On August 27, 2026, it was announced that an earlier version of the @bananacool467/ui-tools package, specifically versions 0.1.0-beta through 0.1.7-beta, contained a security vulnerability. This issue involved an unauthenticated WebSocket terminal endpoint that allowed clients to interact with a PTY running on the server. The OSV advisory MAL-2026-13416 identifies these versions as affected, with the malicious-packages record also available for reference.\n\nThe developers addressed the issue in version 0.1.9-beta, which added authentication before the WebSocket upgrade was accepted. This means that unauthenticated connections are now rejected before the WebSocket is upgraded, preventing unauthorized access to the terminal functionality. To resolve the vulnerability, users are advised to update to version 0.1.9-beta or newer. This can be done using the command `npm install @bananacool467/ui-tools@latest` or explicitly specifying the version with `npm install @bananacool467/ui-tools@0.1.9-beta`.\n\nTo check the installed version, users can run `npm ls @bananacool467/ui-tools`. The issue was not with the terminal functionality itself, which is intentional in the @bananacool467/ui-tools package, but rather with the lack of authentication in the earlier version of the WebSocket endpoint. The terminal functionality is useful for development and UI purposes, but the security flaw posed a risk to server security. The OSV record for this advisory is available at https://api.osv.dev/v1/vulns/MAL-2026-13416.",
  "summary": "Published : August 27, 2026 Package : @bananacool467/ui-tools I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools . Versions 0.1.0-beta through 0.1.7-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server. The issue has since been addressed. Affected versions…",
  "key_points": [
    "Versions 0.1.0-beta through 0.1.7-beta contain security vulnerability",
    "Unauthenticated WebSocket endpoint allows server PTY interaction",
    "Update to 0.1.9-beta or newer to resolve vulnerability"
  ],
  "editors_take": "Updating to version 0.1.9-beta or newer of the @bananacool467/ui-tools package fixes the security vulnerability by adding authentication to prevent unauthorized access to the terminal functionality.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}