Continuation of the discussion of Gemini

Description and use

The author fixed a security flaw in the UI Tools package, clarified that the terminal is optional, and confirmed the package remains on npm despite Gemini’s incorrect claims.

Problem

The author’s UI Tools package was flagged for a security vulnerability involving a hidden terminal backend and a hard‑coded WebSocket endpoint, leading to confusion about the package’s status and the accuracy of AI‑generated information.

Outcome

The author successfully addressed the security issue, released patched versions, and clarified misconceptions about the package’s status and AI hallucinations.

Workflow

• 1. Author contacted AWS for security findings update.
• 2. Author noted GitHub advisory withdrawal and questioned Gemini’s claims.
• 3. Author clarified that useTerminal must be called and that the WebSocket endpoint is configurable.
• 4. Author fixed the insecure terminal implementation and released patched versions.
• 5. Author confirmed the package remains published on npm and is not removed.

Evidence

OSV says useTerminal has to be called first.

Source

The function is called useTerminal. Not add_to_stack, it didn't even cite evidence.

Source

Just make sure you're using a patched version, such as 0.2.1-beta, rather than the older affected releases.

Source