MAL-2026-13416

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bananacool467/ui-tools/MAL-2026-13416.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13416
Published
2026-08-06T13:54:59Z
Modified
2026-08-06T14:34:44.782941226Z
Summary
Malicious code in @bananacool467/ui-tools (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a)

The package advertises itself as a UI-components library (README compares it to MUI), but its main export surface includes useTerminal, a server-side middleware that stands up a WebSocketServer (default path /terminal-stream) and, on every incoming WS message, spawns an interactive bash/powershell PTY via pty.spawn with the server process's own environment ({...process.env, TERM: 'xterm-256color'}) and cwd set to the user's home directory. Bytes received from the WebSocket are written directly into the PTY (session.ptyProcess.write(parsed.data), with a fallback that writes raw message bytes), and PTY output is streamed back to the socket. No authentication, origin check, or handshake token gates the connection. dist/terminal.js ships the matching browser client (exported as Terminal) that connects to that same WebSocket and pipes keystrokes as {type:'input', data:...}, so the package ships both ends of a remote-shell channel. A consumer who mounts the exported hook — expecting a UI helper — exposes a full unauthenticated interactive shell on their server, executing as the server process. The mismatch between the marketed purpose (UI kit) and the shipped capability (network-driven RCE) is the shape of a backdoor delivered under a benign cover story.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-08-06T13:55:41Z",
            "source": "amazon-inspector",
            "sha256": "0d337474263007de40c775c5c4500763ad7cbff8e9b54d79a582a0b6fb4d139d",
            "import_time": "2026-08-06T14:19:54.415112201Z",
            "id": "IN-MAL-2026-016540",
            "versions": [
                "0.1.4-beta"
            ]
        },
        {
            "modified_time": "2026-08-06T13:55:16Z",
            "source": "amazon-inspector",
            "sha256": "5991f35a262a51cff7281c996ef2d1144a8c65b7e34fac0f8e4c50a37497a1ee",
            "import_time": "2026-08-06T14:19:54.288432252Z",
            "id": "IN-MAL-2026-016537",
            "versions": [
                "0.1.0-beta"
            ]
        },
        {
            "modified_time": "2026-08-06T13:54:59Z",
            "source": "amazon-inspector",
            "sha256": "670f91096b9ea8ce914ab9b1a20008e857d22d56e34594d4b5a1d5d3afa738df",
            "import_time": "2026-08-06T14:19:54.148995325Z",
            "id": "IN-MAL-2026-016535",
            "versions": [
                "0.1.7-beta"
            ]
        },
        {
            "modified_time": "2026-08-06T13:55:09Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016536",
            "import_time": "2026-08-06T14:19:54.197979648Z",
            "sha256": "7391923ba77010e63c1db49995312cd901928f6be0289462dcb4039d1853d11f",
            "versions": [
                "0.1.3-beta"
            ]
        },
        {
            "modified_time": "2026-08-06T13:55:33Z",
            "source": "amazon-inspector",
            "sha256": "9920f1bf1620daef56a77d3112e7a217b6f878f4c790cfe3f8ae4edea0c94d4a",
            "import_time": "2026-08-06T14:19:54.380527986Z",
            "id": "IN-MAL-2026-016539",
            "versions": [
                "0.1.1-beta"
            ]
        },
        {
            "source": "amazon-inspector",
            "modified_time": "2026-08-06T13:55:48Z",
            "id": "IN-MAL-2026-016541",
            "import_time": "2026-08-06T14:19:54.532670124Z",
            "sha256": "b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a",
            "versions": [
                "0.1.5-beta"
            ]
        },
        {
            "modified_time": "2026-08-06T13:55:25Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016538",
            "import_time": "2026-08-06T14:19:54.339489463Z",
            "sha256": "d3c33a8678507b16d614ad420edfe676344fef512dc802d53f8abc8011e412ed",
            "versions": [
                "0.1.2-beta"
            ]
        },
        {
            "modified_time": "2026-08-06T13:55:56Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-016542",
            "import_time": "2026-08-06T14:19:54.588819099Z",
            "sha256": "dd34721be117e648163f7b21b2fb300241bb6f2010004d51d2eeb1edac1c7695",
            "versions": [
                "0.1.6-beta"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @bananacool467/ui-tools

Package

Name
@bananacool467/ui-tools
View open source insights on deps.dev
Purl
pkg:npm/%40bananacool467/ui-tools

Affected ranges

Affected versions

0.*
0.1.0-beta
0.1.1-beta
0.1.2-beta
0.1.3-beta
0.1.4-beta
0.1.5-beta
0.1.6-beta
0.1.7-beta

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "ui-tools-0.1.4-beta.tgz",
            "hashes": {
                "sha512_sri": "sha512-31KOBbQini2Mm7wls8qYxCycvJdjEN4nbaRzy72WRCoF0T/WXgxd5gPYBiNT28Y+sCnOWk7kiTE/DbmGF9VxSg==",
                "sha1": "cea41e8941a97596cf071a028c03e2fd75b85fe4"
            }
        }
    ],
    "evidence_files": [
        {
            "tlsh": "14c1ae4978f7013a41f7f13a1e3b80493772c0133195da61baae96146fd9e38e391bb8",
            "sha256": "47c716cd5f1705bedd3e40bd2752846d694faac461f89655d17a0a487aca1a84",
            "path": "dist/useTerminal.js"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@bananacool467/ui-tools/MAL-2026-13416.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]