@bananacool467/ui-tools

{"modified":"2026-08-06T14:21:50Z","published":"2026-08-06T13:54:59Z","schema_version":"1.7.4","id":"MAL-2026-13416","summary":"Malicious code in @bananacool467/ui-tools (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a)\nThe package advertises itself as a UI-components library (README compares it to MUI), but its main export surface includes `useTerminal`, a server-side middleware that stands up a WebSocketServer (default path `/terminal-stream`) and, on every incoming WS message, spawns an interactive bash/powershell PTY via `pty.spawn` with the server process's own environment (`{...process.env, TERM: 'xterm-256color'}`) and cwd set to the user's home directory. Bytes received from the WebSocket are written directly into the PTY (`session.ptyProcess.write(parsed.data)`, with a fallback that writes raw message bytes), and PTY output is streamed back to the socket. No authentication, origin check, or handshake token gates the connection. `dist/terminal.js` ships the matching browser client (exported as `Terminal`) that connects to that same WebSocket and pipes keystrokes as `{type:'input', data:...}`, so the package ships both ends of a remote-shell channel. A consumer who mounts the exported hook — expecting a UI helper — exposes a full unauthenticated interactive shell on their server, executing as the server process. The mismatch between the marketed purpose (UI kit) and the shipped capability (network-driven RCE) is the shape of a backdoor delivered under a benign cover story.\n","affected":[{"package":{"ecosystem":"npm","name":"@bananacool467/ui-tools"},"versions":["0.1.4-beta","0.1.0-beta","0.1.7-beta","0.1.3-beta","0.1.1-beta","0.1.5-beta","0.1.2-beta","0.1.6-beta"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/useTerminal.js","sha256":"47c716cd5f1705bedd3e40bd2752846d694faac461f89655d17a0a487aca1a84","tlsh":"14c1ae4978f7013a41f7f13a1e3b80493772c0133195da61baae96146fd9e38e391bb8"}],"package_integrity":[{"filename":"ui-tools-0.1.4-beta.tgz","hashes":{"sha1":"cea41e8941a97596cf071a028c03e2fd75b85fe4","sha512_sri":"sha512-31KOBbQini2Mm7wls8qYxCycvJdjEN4nbaRzy72WRCoF0T/WXgxd5gPYBiNT28Y+sCnOWk7kiTE/DbmGF9VxSg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.4-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.0-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.7-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.3-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.1-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.5-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.2-beta"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@bananacool467/ui-tools/v/0.1.6-beta"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016540","import_time":"2026-08-06T14:19:54.415112201Z","modified_time":"2026-08-06T13:55:41Z","sha256":"0d337474263007de40c775c5c4500763ad7cbff8e9b54d79a582a0b6fb4d139d","source":"amazon-inspector","versions":["0.1.4-beta"]},{"id":"IN-MAL-2026-016537","import_time":"2026-08-06T14:19:54.288432252Z","modified_time":"2026-08-06T13:55:16Z","sha256":"5991f35a262a51cff7281c996ef2d1144a8c65b7e34fac0f8e4c50a37497a1ee","source":"amazon-inspector","versions":["0.1.0-beta"]},{"id":"IN-MAL-2026-016535","import_time":"2026-08-06T14:19:54.148995325Z","modified_time":"2026-08-06T13:54:59Z","sha256":"670f91096b9ea8ce914ab9b1a20008e857d22d56e34594d4b5a1d5d3afa738df","source":"amazon-inspector","versions":["0.1.7-beta"]},{"id":"IN-MAL-2026-016536","import_time":"2026-08-06T14:19:54.197979648Z","modified_time":"2026-08-06T13:55:09Z","sha256":"7391923ba77010e63c1db49995312cd901928f6be0289462dcb4039d1853d11f","source":"amazon-inspector","versions":["0.1.3-beta"]},{"id":"IN-MAL-2026-016539","import_time":"2026-08-06T14:19:54.380527986Z","modified_time":"2026-08-06T13:55:33Z","sha256":"9920f1bf1620daef56a77d3112e7a217b6f878f4c790cfe3f8ae4edea0c94d4a","source":"amazon-inspector","versions":["0.1.1-beta"]},{"id":"IN-MAL-2026-016541","import_time":"2026-08-06T14:19:54.532670124Z","modified_time":"2026-08-06T13:55:48Z","sha256":"b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a","source":"amazon-inspector","versions":["0.1.5-beta"]},{"id":"IN-MAL-2026-016538","import_time":"2026-08-06T14:19:54.339489463Z","modified_time":"2026-08-06T13:55:25Z","sha256":"d3c33a8678507b16d614ad420edfe676344fef512dc802d53f8abc8011e412ed","source":"amazon-inspector","versions":["0.1.2-beta"]},{"id":"IN-MAL-2026-016542","import_time":"2026-08-06T14:19:54.588819099Z","modified_time":"2026-08-06T13:55:56Z","sha256":"dd34721be117e648163f7b21b2fb300241bb6f2010004d51d2eeb1edac1c7695","source":"amazon-inspector","versions":["0.1.6-beta"]}]}}