268277 matches found
MAL-2026-16236 Malicious code in strapi-plugin-perev-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...
Malicious code in strapi-plugin-ccip-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...
MAL-2026-16226 Malicious code in strapi-plugin-ccip-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...
Malicious code in strapi-plugin-honey-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766 The package's postinstall lifecycle script postinstall.js spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP...
MAL-2026-16231 Malicious code in strapi-plugin-honey-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766 The package's postinstall lifecycle script postinstall.js spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP...
Malicious code in strapi-plugin-conresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes...
MAL-2026-16229 Malicious code in strapi-plugin-conresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes...
MAL-2026-16230 Malicious code in strapi-plugin-feedmeeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse...
Malicious code in strapi-plugin-feedmeeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse...
Malicious code in strapi-plugin-portcc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the...
MAL-2026-16238 Malicious code in strapi-plugin-portcc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the...
Malicious code in strapi-plugin-maylog-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded...
MAL-2026-16233 Malicious code in strapi-plugin-maylog-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded...
MAL-2026-16232 Malicious code in strapi-plugin-listcc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0 [email protected] declares scripts.postinstall = 'node postinstall.js' and points main at the same file, so npm install auto-executes...
Malicious code in strapi-plugin-listcc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0 [email protected] declares scripts.postinstall = 'node postinstall.js' and points main at the same file, so npm install auto-executes...
CVE-2026-92140
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
CVE-2026-92140
The Jenkins Gitee Plugin (version 1301.v8957053c7902 and earlier) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape the sender name from Gitee push webhook payloads in build causes. Attackers capable of triggering builds via the Jenkins Gi...
CVE-2026-92140
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...
EUVD-2026-80764
Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...