MAL-2026-13422 Malicious code in beautiful-ui-monitoring (npm)

[email protected] advertises itself as a UI package (description 'creates a beautiful ui design', keywords c/gcc/native) but ships no UI code. Its postinstall script invokes gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c, compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a __attribute__((constructor)) that, on load, unlinks every *.so file under /tmp and writes the current uid/gid to /tmp/monitoring.log. The tarball also ships a test.js that loads the library via LD_PRELOAD=/tmp/monitoring.so and a co-shipped native test-loader that dlopens the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.