The @bananacool467/ui-tools npm package includes a server-side middleware called useTerminal that creates a WebSocketServer at the path /terminal-stream. Incoming WebSocket messages are directly written into a spawned PTY (bash or powershell) running with the server's environment and home directory as the working directory. Output from the PTY is streamed back to the client. There is no authentication, origin verification, or handshake token protecting this WebSocket connection. The package also provides a browser client that connects to this WebSocket and sends keystrokes, effectively enabling an unauthenticated remote shell with full command execution capabilities on the server process. This functionality is hidden under the guise of a UI toolkit, constituting a backdoor.

Any server that installs and uses this package and mounts the exported useTerminal hook exposes itself to full unauthenticated remote code execution. Attackers can execute arbitrary commands with the privileges of the server process, potentially leading to complete system compromise. The lack of any authentication or access controls makes exploitation trivial once the package is in use.

No official patch or remediation is currently available. Users should immediately remove the @bananacool467/ui-tools package from their projects and avoid using any versions listed as affected. Audit your dependencies to ensure this package is not included transitively. Consider rebuilding affected environments after removal to ensure no persistent backdoors remain.