Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer

Published : August 27, 2026 Package : @bananacool467/ui-tools I want to clarify a security issue affecting earlier versions of @bananacool467/ui-tools . Versions 0.1.0-beta through 0.1.7-beta contained an unauthenticated WebSocket terminal endpoint. This allowed a client connecting to the endpoint to interact with a PTY running on the server. The issue has since been addressed. Affected versions The OSV advisory MAL-2026-13416 currently identifies these versions as affected: 0.1.0-beta 0.1.1-beta 0.1.2-beta 0.1.3-beta 0.1.4-beta 0.1.5-beta 0.1.6-beta 0.1.7-beta The advisory was generated from findings by Amazon Inspector and includes hashes identifying the affected package artifacts. Patched versions Do not use the affected versions 0.1.0-beta through 0.1.7-beta . Use 0.1.9-beta or newer. In 0.1.9-beta, I added authentication before the WebSocket upgrade is accepted. The 0.1.9-beta implementation checks the token before calling handleUpgrade() , so unauthenticated connections are rejected before the WebSocket is upgraded. In other words, knowing the WebSocket endpoint alone is no longer sufficient to establish a terminal session. What should I do? If your project uses an affected version, update it: npm install @bananacool467/ui-tools@latest Or explicitly: npm install @bananacool467/ui-tools@0.1.9-beta You can check your installed version with: npm ls @bananacool467/ui-tools If you're using a version from 0.1.0-beta through 0.1.7-beta , upgrade immediately . What happened? The terminal functionality is intentional. ui-tools is not intended to be a frontend-only component library; it contains various development/UI utilities, including an optional terminal interface. The problem with the earlier implementation was that the terminal WebSocket endpoint did not require authentication. This meant that a server using the terminal functionality could unintentionally expose a shell to anyone who could reach the endpoint. This was not acceptable, and authentication was added