The beautiful-ui-monitoring npm package version 1.0.8 contains malicious code embedded in its postinstall script. Rather than providing UI functionality, it compiles a C source file into a shared library at /tmp/monitoring.so, a world-writable location. This shared library uses a constructor attribute to execute code upon loading that unlinks (deletes) all *.so files in /tmp and writes the current UID and GID to /tmp/monitoring.log. The package includes test scripts that load this library via LD_PRELOAD and dlopen, demonstrating the intended destructive trigger. The package author is unspecified, and the package does not implement its advertised UI features, indicating deliberate deception and malicious intent.

Installation of this package results in the creation and potential loading of a native shared library that deletes shared object files in the /tmp directory, which could disrupt other processes relying on those files. The malicious code also logs user and group IDs, potentially aiding further malicious activity. The destructive behavior affects the shared temporary directory, which is world-writable and commonly used by many applications, potentially causing denial of service or instability on the affected system.

No official patch or remediation is currently available for this package. The best mitigation is to avoid installing [email protected] and remove it if already installed. Since this is a malicious package, users should rely on trusted sources and verify package authenticity before installation. Monitor and clean the /tmp directory for any residual malicious artifacts such as monitoring.so or monitoring.log. Consider using package integrity verification tools and restricting write permissions to /tmp where feasible.