Continuation of the discussion of Gemini

说明与用途

作者修复了 UI Tools 包中的安全漏洞，澄清终端是可选功能，并确认尽管 Gemini 的错误声明，包仍在 npm 上可用。

问题

The author’s UI Tools package was flagged for a security vulnerability involving a hidden terminal backend and a hard‑coded WebSocket endpoint, leading to confusion about the package’s status and the accuracy of AI‑generated information.

结果

The author successfully addressed the security issue, released patched versions, and clarified misconceptions about the package’s status and AI hallucinations.

工作流

• 1. Author contacted AWS for security findings update.
• 2. Author noted GitHub advisory withdrawal and questioned Gemini’s claims.
• 3. Author clarified that useTerminal must be called and that the WebSocket endpoint is configurable.
• 4. Author fixed the insecure terminal implementation and released patched versions.
• 5. Author confirmed the package remains published on npm and is not removed.

证据

OSV says useTerminal has to be called first.

来源

The function is called useTerminal. Not add_to_stack, it didn't even cite evidence.

来源

Just make sure you're using a patched version, such as 0.2.1-beta, rather than the older affected releases.

来源