beautiful-ui-monitoring @1.0.8

Summary

beautiful-ui-monitoring@1.0.8 advertises itself as a UI package (description 'creates a beautiful ui design', keywords c/gcc/native) but ships no UI code. Its postinstall script invokes gcc -shared -fPIC -o /tmp/monitoring.so src/monitoring.c , compiling a shipped C source into a shared library at a world-writable path. The compiled library declares a __attribute__((constructor)) that, on load, unlinks every *.so file under /tmp and writes the current uid/gid to /tmp/monitoring.log . The tarball also ships a test.js that loads the library via LD_PRELOAD=/tmp/monitoring.so and a co-shipped native test-loader that dlopen s the same path, demonstrating the intended trigger. The package.json author field is empty and no shipped file implements the advertised UI purpose. Installing the package plants a destructive native artifact in a shared, world-writable location under a misleading package description.

Source: amazon-inspector (ca55a4e9c07b4e285b702c515ae40bba4c641662d4513f2e26cb99e111cd3101)