npm package @bananacool467/ui-tools patched for unauthenticated terminal flaw

·2 views

A security vulnerability has been disclosed in the npm package @bananacool467/ui-tools, affecting versions 0.1.0-beta through 0.1.7-beta. These versions exposed an unauthenticated WebSocket terminal endpoint, potentially allowing anyone with network access to interact with a server-side shell session. The flaw is tracked under OSV advisory MAL-2026-13416, identified through findings by Amazon Inspector. The maintainer addressed the issue in version 0.1.9-beta by adding token-based authentication before the WebSocket upgrade is accepted. Users running any affected version are advised to upgrade immediately using npm install @bananacool467/ui-tools@0.1.9-beta or later.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

GitHub Trending: Lightweight AI Agents and Local MoE Engines Lead Open Source Charts

GitHub's trending repositories for the week of August 28, 2026, reflect a clear shift toward autonomous, resource-efficient AI tooling. DeepSeek Harness, built in TypeScript, offers a fully plugin-based framework that lets developers swap AI pipeline components — from inference to post-processing — without vendor lock-in. Ponytail, a JavaScript-based AI agent, promotes a code-minimalist philosophy by maximizing reuse and discouraging redundant implementations. Colibri, written in pure C with no external dependencies, enables frontier-scale Mixture of Experts models to run on consumer hardware by streaming only required model segments from disk. Rounding out the list, Grok-Build from xAI provides a polished, mouse-interactive terminal UI for building AI-assisted coding and CI/CD workflows directly from the command line.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Lightweight Tool to Fix Audience Focus Issues in Remote Demos

A developer identified a recurring UX problem in remote software demos: audiences often struggle to know where to look on a shared screen, especially when the pointer is hard to spot. The issue is compounded when presenters move to the next step before the audience has located the previous one. Existing screen annotation tools, while powerful, can disrupt demo flow by requiring a switch into a separate drawing mode. To address this, the developer built a small utility called Pointer Cue, which lets presenters highlight the cursor or outline a screen area using a keyboard shortcut, without leaving the demo workflow. The tool is available for both Mac and Windows, with a free version offered on the developer's website.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Design Structured API Logs That Separate Request and Delivery Events

Effective API logging for notification services requires recording two distinct events: one at the HTTP request boundary and one for each asynchronous delivery attempt, linked by a stable notification ID. Treating both as a single log entry creates misleading dashboards and weakens incident investigations, particularly when push delivery happens in a separate process seconds after the API response. Key fields for the request event include route, status code, duration, and notification ID, while delivery events should capture attempt number, channel, outcome, and a bounded error category. Three core invariants must be maintained — notification_id tracks the business operation, request_id tracks the HTTP exchange, and duration_ms must have a clearly defined boundary — since silently redefining a field corrupts cross-deployment comparisons. Engineers must also account for failure gaps, such as distinguishing whether a notification was never created versus created but not yet attempted, and should document the actual durability guarantees of their log transport rather than assuming completeness.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Cybercriminals Weaponize GitHub to Distribute Malware at Unprecedented Scale

Threat actors are increasingly exploiting GitHub's trusted infrastructure to stage large-scale malware distribution campaigns, according to a January 2026 analysis by security researcher Brian Tant. Microsoft's investigation into the Storm-0409 malvertising campaign found that attackers infected close to one million devices worldwide using GitHub-hosted malicious code. A separate campaign dubbed GitVenom saw hundreds of fake repositories created over several years, deploying backdoors, remote access tools, and clipboard hijackers that stole approximately five Bitcoin worth around $440,000. Security researchers also identified over 1,300 GitHub repositories vulnerable to RepoJacking, a technique allowing attackers to hijack existing trusted projects and inject malicious code. These campaigns exploit developers' inherent trust in GitHub-hosted content, using professionally crafted README files, realistic commit histories, and GitHub's own release infrastructure to distribute malware such as Lumma Stealer, SectopRAT, and Vidar.

0 comments Read more at DEV Community