{"id":"MAL-2026-16152","summary":"Malicious code in strapi-plugin-os-info-meeb322k (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5)\nThe package declares a postinstall script (postinstall.js) that runs automatically on `npm install`. The script collects host reconnaissance data — os.hostname(), os.platform(), kernel release, uid/gid, all network interface addresses, memory and CPU info — base64-encodes the JSON payload, and POSTs it over plain HTTP to the hardcoded out-of-band host vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com (a Burp Collaborator subdomain). The package name mimics strapi-plugin-os-info but has no legitimate plugin functionality; the only shipped behavior is the install-time beacon to an attacker-controlled OOB interaction endpoint.\n","modified":"2026-09-14T17:30:06.151513769Z","published":"2026-09-14T16:44:18Z","database_specific":{"malicious-packages-origins":[{"modified_time":"2026-09-14T16:44:18Z","sha256":"26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5","source":"amazon-inspector","versions":["3.6.8"],"id":"IN-MAL-2026-020024","import_time":"2026-09-14T17:15:20.603851921Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/strapi-plugin-os-info-meeb322k/v/3.6.8"}],"affected":[{"package":{"name":"strapi-plugin-os-info-meeb322k","ecosystem":"npm","purl":"pkg:npm/strapi-plugin-os-info-meeb322k"},"versions":["3.6.8"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"tlsh":"1b3153d406fa46303ab911c434979823daa1d1163a1ab8f9bcfc06c5dfce5d861727bd","path":"postinstall.js","sha256":"1d1f5e5f6b82627777336227669621baa5daeb3ba2c3a4f517a4de5533be8c5a"}],"package_integrity":[{"filename":"strapi-plugin-os-info-meeb322k-3.6.8.tgz","hashes":{"sha512_sri":"sha512-usm1AGED1tk6F1AIFCZB9Rv2NR0zsf3iGsY4LG6Np3y663q5glKe3hRBtIzb1jhpZ03Amu9cXrBRYvXy4xlBQg==","sha1":"1b3c98af302482f3a08fc6db01180a4869144bba"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-os-info-meeb322k/MAL-2026-16152.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}