MAL-2026-13422

Dashboard / Malicious Package / MAL-2026-13422

MAL-2026-13422

Summary: Malicious code in beautiful-ui-monitoring (npm)

Details: Source: amazon-inspector (ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101) [email protected] advertises itself as a UI package (description 'creates a beautiful ui design', keywords c/gcc/native) but ships no UI code. Its postinstall script invokes `gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c`, compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a `__attribute__((constructor))` that, on load, unlinks every `*.so` file under `/tmp` and writes the current uid/gid to `/tmp/monitoring.log`. The tarball also ships a `test.js` that loads the library via `LD_PRELOAD=/tmp/monitoring.so` and a co-shipped native test-loader that `dlopen`s the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.

References: https://www.npmjs.com/package/beautiful-ui-monitoring/v/1.0.8