beautiful-ui-monitoringnpm
beautiful-ui-monitoring is a confirmed malicious npm package (MAL-2026-13422) that executes malicious code on install (malicious version 1.0.8). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in beautiful-ui-monitoring (npm)
What this malware does
[email protected] advertises itself as a UI package (description 'creates a beautiful ui design', keywords c/gcc/native) but ships no UI code. Its postinstall script invokes gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c, compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a __attribute__((constructor)) that, on load, unlinks every *.so file under /tmp and writes the current uid/gid to /tmp/monitoring.log. The tarball also ships a test.js that loads the library via LD_PRELOAD=/tmp/monitoring.so and a co-shipped native test-loader that dlopens the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for beautiful-ui-monitoring (version 1.0.8). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging beautiful-ui-monitoring across your stack and pipelines.
If you installed it — respond
Remove beautiful-ui-monitoring from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If beautiful-ui-monitoring was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks beautiful-ui-monitoring before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks beautiful-ui-monitoring-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.