beautiful-ui-monitoringnpm
Advisory published Updated
beautiful-ui-monitoring is a confirmed malicious npm package (MAL-2026-13422) that executes malicious code on install (malicious version 1.0.8). Do not install it — remove it immediately and rotate any exposed credentials.
Malicious code in beautiful-ui-monitoring (npm)
What this malware does
[email protected] advertises itself as a UI package (description 'creates a beautiful ui design', keywords c/gcc/native) but ships no UI code. Its postinstall script invokes gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c, compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a __attribute__((constructor)) that, on load, unlinks every *.so file under /tmp and writes the current uid/gid to /tmp/monitoring.log. The tarball also ships a test.js that loads the library via LD_PRELOAD=/tmp/monitoring.so and a co-shipped native test-loader that dlopens the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.
Malicious versions
Indicators of compromise (SHA-256)
Detection & response playbook
Malicious packageFind it
Search your lockfiles and build artifacts for beautiful-ui-monitoring (version 1.0.8).
If you installed it — respond
Remove beautiful-ui-monitoring from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If beautiful-ui-monitoring was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.
Frequently asked questions
Campaign
References
Credits
- Amazon Inspector · finder
Detect & block this
O3 blocks beautiful-ui-monitoring-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.