{"id":"MAL-2026-16238","summary":"Malicious code in strapi-plugin-portcc-meeb (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b)\nPackage advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the package `main`. On install, postinstall.js checks os.hostname() against 'ubuntu-fc-uvm' and then invokes child_process.exec on an inline python3 one-liner that opens a TCP socket to the hardcoded remote host 14.225.210.85:80, dups the socket onto stdin/stdout/stderr, and calls pty.spawn('sh'), yielding an interactive reverse shell on the installer's machine. A retry loop attempts up to five reconnects. The hostname gate is a targeting/anti-analysis check, not a safety limit. The package name and Strapi-plugin framing are a cover story; no legitimate plugin code is present.\n","modified":"2026-09-16T14:30:06.304979334Z","published":"2026-09-16T13:57:39Z","database_specific":{"malicious-packages-origins":[{"versions":["3.6.8"],"id":"IN-MAL-2026-020094","import_time":"2026-09-16T14:19:37.542684546Z","modified_time":"2026-09-16T13:57:39Z","sha256":"5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b","source":"amazon-inspector"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/strapi-plugin-portcc-meeb/v/3.6.8"}],"affected":[{"package":{"name":"strapi-plugin-portcc-meeb","ecosystem":"npm","purl":"pkg:npm/strapi-plugin-portcc-meeb"},"versions":["3.6.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-portcc-meeb/MAL-2026-16238.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"4d4d4c8b33a87d03be45370616b16c71a8b91a8cb12899fac511a5db72cc6993","tlsh":"ba4131ad06bf273a63334ca8521b8097e51701023512d578799c8b53bfd5d99c531bf9","path":"postinstall.js"}],"package_integrity":[{"filename":"strapi-plugin-portcc-meeb-3.6.8.tgz","hashes":{"sha512_sri":"sha512-1rd5y8D3PmVFpCWsPT+NPZo8c526zeK6CdTqjtG0k1bcA7ilzmmN9Z7hTrFEvUTuHgaVL8gkqrZd16hKPmdi/g==","sha1":"90f1b9b173577dd3bd2a4ed9f1870b6659d013d5"}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}