Malicious code in strapi-plugin-honey-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766 The package's postinstall lifecycle script postinstall.js spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP...

Malicious code in strapi-plugin-conresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes...

MAL-2026-16229 Malicious code in strapi-plugin-conresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes...

MAL-2026-16230 Malicious code in strapi-plugin-feedmeeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse...

Malicious code in strapi-plugin-feedmeeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse...

Malicious code in strapi-plugin-portcc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the...

MAL-2026-16238 Malicious code in strapi-plugin-portcc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the...

Malicious code in strapi-plugin-maylog-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded...

MAL-2026-16233 Malicious code in strapi-plugin-maylog-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded...

Malicious code in strapi-plugin-listcc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0 [email protected] declares scripts.postinstall = 'node postinstall.js' and points main at the same file, so npm install auto-executes...

MAL-2026-16232 Malicious code in strapi-plugin-listcc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0 [email protected] declares scripts.postinstall = 'node postinstall.js' and points main at the same file, so npm install auto-executes...

CVE-2026-92140

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

CVE-2026-92140

The Jenkins Gitee Plugin (version 1301.v8957053c7902 and earlier) is vulnerable to a stored cross-site scripting (XSS) vulnerability. The root cause is the failure to escape the sender name from Gitee push webhook payloads in build causes. Attackers capable of triggering builds via the Jenkins Gi...

CVE-2026-92140

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

EUVD-2026-80764

Jenkins Gitee Plugin 1301.v8957053c7902 and earlier does not escape the sender name from Gitee push webhook payloads in build causes, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to trigger builds via the Jenkins Gitee Plugin webhook endpoint...

CVE-2026-92141

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

CVE-2026-92138

The OAuth authorization endpoint in Jenkins Bitbucket Server Integration Plugin 6.0.1 and earlier reads the oauthcallback URL from the submitted form rather than from the server-side stored request token, allowing attackers to hijack the OAuth flow and obtain an access token on behalf of the vict...

CVE-2026-92139

The Jenkins Bitbucket Push and Pull Request Plugin version 4.0.1 and earlier is vulnerable to a Server-Side Request Forgery (SSRF) flaw. The plugin provides a webhook endpoint at /bitbucket-hook/ that trusts values within the webhook payload, specifically certain URLs . An attacker can send a cra...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...

CVE-2026-92139

Jenkins Bitbucket Push and Pull Request Plugin 4.0.1 and earlier trusts values provided in the webhook payload, including certain URLs, and uses configured Bitbucket credentials to connect to those URLs, allowing attackers to capture Bitbucket credentials stored in Jenkins by sending a crafted...