Continuation of the discussion of Gemini

Описание и применение

Автор исправил уязвимость в пакете UI Tools, разъяснил, что терминал является опциональной функцией, и подтвердил, что пакет всё ещё доступен на npm, несмотря на ложные утверждения Gemini.

Задача

The author’s UI Tools package was flagged for a security vulnerability involving a hidden terminal backend and a hard‑coded WebSocket endpoint, leading to confusion about the package’s status and the accuracy of AI‑generated information.

Результат

The author successfully addressed the security issue, released patched versions, and clarified misconceptions about the package’s status and AI hallucinations.

Рабочий процесс

• 1. Author contacted AWS for security findings update.
• 2. Author noted GitHub advisory withdrawal and questioned Gemini’s claims.
• 3. Author clarified that useTerminal must be called and that the WebSocket endpoint is configurable.
• 4. Author fixed the insecure terminal implementation and released patched versions.
• 5. Author confirmed the package remains published on npm and is not removed.

Доказательства

OSV says useTerminal has to be called first.

Источник

The function is called useTerminal. Not add_to_stack, it didn't even cite evidence.

Источник

Just make sure you're using a patched version, such as 0.2.1-beta, rather than the older affected releases.

Источник