beautiful-ui-monitoring

{"modified":"2026-08-06T13:11:08Z","published":"2026-08-06T13:11:08Z","schema_version":"1.7.4","id":"MAL-2026-13422","summary":"Malicious code in beautiful-ui-monitoring (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101)\nbeautiful-ui-monitoring@1.0.8 advertises itself as a UI package (description 'creates a beautiful ui design', keywords c/gcc/native) but ships no UI code. Its postinstall script invokes `gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c`, compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a `__attribute__((constructor))` that, on load, unlinks every `*.so` file under `/tmp` and writes the current uid/gid to `/tmp/monitoring.log`. The tarball also ships a `test.js` that loads the library via `LD_PRELOAD=/tmp/monitoring.so` and a co-shipped native test-loader that `dlopen`s the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.\n","affected":[{"package":{"ecosystem":"npm","name":"beautiful-ui-monitoring"},"versions":["1.0.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"d87f2e2c7175be3c97b8ec3acff9ffc52e4b7f1e9d1fe230ee5df4493260b6f5","tlsh":"94e07d30cd215db334c0ae311e31538af8714c1f42d4b90863ab4018439f67e09fa50d"}],"package_integrity":[{"filename":"beautiful-ui-monitoring-1.0.8.tgz","hashes":{"sha1":"735257754d58181f05aea45a2072c187146d5d0a","sha512_sri":"sha512-YJbJH6LRMxzwA06VQ004NhZ7e26khAxsGOkW9TI1EQAzUsm7PEV6mc8VLQ2ama6SeJRzTY9dYxUAnCkkWpe24Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/beautiful-ui-monitoring/v/1.0.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-016367","import_time":"2026-08-06T14:19:45.467772403Z","modified_time":"2026-08-06T13:11:08Z","sha256":"ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101","source":"amazon-inspector","versions":["1.0.8"]}]}}