Gemini brands npm maintainer malicious over fixed advisory, invents supply-chain campaign

What happened

An npm developer says Gemini is telling users their packages are malware and that the author should be treated as a compromised identity, even though the one real security flaw was fixed and the affected versions deprecated. In a dev.to post published on 3 September, the maintainer — publishing under the npm scope @bananacool467 and the name bananakitssu — describes a loop they cannot break out of: an AI assistant keeps repeating a verdict built on an outdated advisory, and corrections do not stick.

The package at the centre of it, @bananacool467/ui-tools, is a UI toolkit with an optional backend component. That backend included a terminal server exposing a WebSocket PTY shell and, as the maintainer admits, it shipped with no authentication. That part was a genuine problem: an unauthenticated remote shell is a textbook remote-code-execution exposure. The advisory in question, MAL-2026-13416, covered versions 0.1.0-beta through 0.1.7-beta. According to the post, authentication tokens were added in 0.1.9-beta, and the maintainer deprecated the affected releases, including 0.1.8-beta.

The fix that never registers

When the maintainer asked Gemini about the package, the assistant reportedly described the code as malicious, advised deleting the package and rotating all credentials, and kept that position even after being shown the dev.to write-up documenting the fix. When challenged directly on the facts, it conceded that authentication had been added — then pivoted to arguing that a terminal does not belong in a UI package, so the package remained dangerous. The maintainer notes the package description explicitly covers both frontend and backend tooling.

Other conversations drifted further from the record. Gemini allegedly claimed version 1.0.0 executes a malicious payload at install time; that version does not exist, and the package manifest contains no install-time hooks. The maintainer traces this to DependencyWatch.io data that guesses at install-time execution, and suspects a Vulners summary sits behind wording about the package pretending to be a normal toolkit that secretly opens a shell.

A campaign that exists only in the answer

The most consequential exchange came when the maintainer listed their other projects. According to the post, Gemini responded with a full threat-intelligence write-up: PT, Authtics, Authtics Host, BTDPE, BananaSDK and the Swiq programming language were described as a "multi-package supply-chain threat campaign" using coordinated naming to establish persistence and compromise developer infrastructure, complete with a table of entity behaviours and indicators of compromise.

The maintainer says none of it is real — the names are their own projects. The problem is less the error than the form it takes: attribution, IoC checklists and citations give the fabrication the texture of a genuine security report, exactly the kind of output that gets pasted into audits, issue trackers and registry reports.

Why it matters

The account is a single first-person post and cannot be independently verified from this material, and the underlying vulnerability was real, which complicates any clean victim narrative. But three failure modes stand on their own:

• Staleness. A model summarising an advisory without checking version ranges cannot see remediation, so shipping a fix buys the maintainer nothing.
• Scope inflation. One insecure package became all packages by this author, then advice to treat the author as a compromised identity, then an invented multi-ecosystem campaign.
• Confident confabulation. Non-existent versions, imagined install hooks and a fake threat-actor narrative, delivered with the formatting of professional threat intelligence.

As developers increasingly ask AI assistants whether a dependency is safe to install, a wrong verdict with no correction channel becomes a reputational problem no patch can fix. Maintainers can deprecate a version; they cannot deprecate what the model says about them.