{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "package.json",
              "sha256": "d87f2e2c7175be3c97b8ec3acff9ffc52e4b7f1e9d1fe230ee5df4493260b6f5",
              "tlsh": "94e07d30cd215db334c0ae311e31538af8714c1f42d4b90863ab4018439f67e09fa50d"
            }
          ],
          "package_integrity": [
            {
              "filename": "beautiful-ui-monitoring-1.0.8.tgz",
              "hashes": {
                "sha1": "735257754d58181f05aea45a2072c187146d5d0a",
                "sha512_sri": "sha512-YJbJH6LRMxzwA06VQ004NhZ7e26khAxsGOkW9TI1EQAzUsm7PEV6mc8VLQ2ama6SeJRzTY9dYxUAnCkkWpe24Q=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "beautiful-ui-monitoring"
      },
      "versions": [
        "1.0.8"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-016367",
        "import_time": "2026-08-06T14:19:45.467772403Z",
        "modified_time": "2026-08-06T13:11:08Z",
        "sha256": "ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101",
        "source": "amazon-inspector",
        "versions": [
          "1.0.8"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101)\nbeautiful-ui-monitoring@1.0.8 advertises itself as a UI package (description \u0027creates a beautiful ui design\u0027, keywords c/gcc/native) but ships no UI code. Its postinstall script invokes `gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c`, compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a `__attribute__((constructor))` that, on load, unlinks every `*.so` file under `/tmp` and writes the current uid/gid to `/tmp/monitoring.log`. The tarball also ships a `test.js` that loads the library via `LD_PRELOAD=/tmp/monitoring.so` and a co-shipped native test-loader that `dlopen`s the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.\n",
  "id": "MAL-2026-13422",
  "modified": "2026-08-06T13:11:08Z",
  "published": "2026-08-06T13:11:08Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/beautiful-ui-monitoring/v/1.0.8"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in beautiful-ui-monitoring (npm)"
}