MalwarePublished 6 Aug 2026

beautiful-ui-monitoring (npm) · Malicious Code

Affects beautiful-ui-monitoringSource GCVE Database

Malicious package : remove beautiful-ui-monitoring and rotate any secrets on hosts that installed it.

Data as of 6 Aug 2026, 18:39 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13422

What to do

Remove beautiful-ui-monitoring from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbeautiful-ui-monitoring	Affected =1.0.8	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package beautiful-ui-monitoring version 1.0.8 is a malicious package that falsely advertises itself as a UI design tool but contains no UI code. Instead, its postinstall script compiles a native shared library to a world-writable temporary directory. This library, when loaded, deletes all shared object files (*.so) under /tmp and logs the current user and group IDs to a file. The package author field is empty, and the package includes test code demonstrating the malicious behavior. Installing this package results in planting a destructive native artifact in a shared location under misleading pretenses.

Impact

Installation of this package results in the creation and potential loading of a native shared library that deletes shared object files in the /tmp directory, which could disrupt other processes relying on those files. The malicious code also logs user and group IDs, potentially aiding further malicious activity. The destructive behavior affects the shared temporary directory, which is world-writable and commonly used by many applications, potentially causing denial of service or instability on the affected system.

Defensive guidance

The best mitigation is to avoid installing beautiful-ui-monitoring@1.0.8 and remove it if already installed. Since this is a malicious package, users should rely on trusted sources and verify package authenticity before installation. Monitor and clean the /tmp directory for any residual malicious artifacts such as monitoring.so or monitoring.log. Consider using package integrity verification tools and restricting write permissions to /tmp where feasible.

Summary

The beautiful-ui-monitoring npm package version 1.0.8 contains malicious code embedded in its postinstall script. Rather than providing UI functionality, it compiles a C source file into a shared library at /tmp/monitoring.so, a world-writable location. This shared library uses a constructor attribute to execute code upon loading that unlinks (deletes) all *.so files in /tmp and writes the current UID and GID to /tmp/monitoring.log. The package includes test scripts that load this library via LD_PRELOAD and dlopen, demonstrating the intended destructive trigger. The package author is unspecified, and the package does not implement its advertised UI features, indicating deliberate deception and malicious intent.

References

npmjs.com/package/beautiful-ui-monitoring/v/1.0.8 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Aug 2026, 18:39 UTC

Technical details

References

Community reviews