MalwarePublished 6 Aug 2026

@bananacool467/ui-tools (npm) · Malicious Code

Affects @bananacool467/ui-toolsSource GCVE Database

Malicious package : remove @bananacool467/ui-tools and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:34 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13416

What to do

Remove @bananacool467/ui-tools from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@bananacool467/ui-tools	Affected 0.1.0-beta – 0.1.7-beta 8 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @bananacool467/ui-tools, marketed as a UI-components library, contains malicious code that implements an unauthenticated WebSocket server exposing an interactive shell on the server. This backdoor allows remote command execution as the server process without any authentication or origin checks. The package ships both the server-side middleware and a browser client that together create a remote shell channel, posing a severe security risk to any system using it.

Impact

Any server that installs and uses this package and mounts the exported useTerminal hook exposes itself to full unauthenticated remote code execution. Attackers can execute arbitrary commands with the privileges of the server process, potentially leading to complete system compromise. The lack of any authentication or access controls makes exploitation trivial once the package is in use.

Defensive guidance

Users should immediately remove the @bananacool467/ui-tools package from their projects and avoid using any versions listed as affected. Audit your dependencies to ensure this package is not included transitively. Consider rebuilding affected environments after removal to ensure no persistent backdoors remain.

Summary

The @bananacool467/ui-tools npm package includes a server-side middleware called useTerminal that creates a WebSocketServer at the path /terminal-stream. Incoming WebSocket messages are directly written into a spawned PTY (bash or powershell) running with the server's environment and home directory as the working directory. Output from the PTY is streamed back to the client. There is no authentication, origin verification, or handshake token protecting this WebSocket connection. The package also provides a browser client that connects to this WebSocket and sends keystrokes, effectively enabling an unauthenticated remote shell with full command execution capabilities on the server process. This functionality is hidden under the guise of a UI toolkit, constituting a backdoor.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:34 UTC

Technical details

References

Community reviews