MAL-2026-16209

    Dashboard / Malicious Package / MAL-2026-16209

    MAL-2026-16209

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in strapi-plugin-ccsuc-meeb (npm)

    Details: Source: amazon-inspector (8fb6207f1b4ec4d94c724583a5f32b85f68d203e1a9e6372705b410efbf9173a) The package's postinstall lifecycle script (postinstall.js, wired via scripts.postinstall in package.json) checks the installer's hostname against a hardcoded allowlist value ('ubuntu-fc-uvm') and, on match, spawns /bin/bash with a reverse-shell one-liner opening an interactive TCP shell to 14.225.210.85:80. The script uses child_process.exec, includes retry logic and a 60-second timeout, and runs automatically on `npm install`. The hostname gate indicates a targeted-dropper shape aimed at specific installer environments; on matching hosts the operator obtains full interactive command execution on the installer's machine.

    References: https://www.npmjs.com/package/strapi-plugin-ccsuc-meeb/v/3.6.8

    Affected packages

    Package

    Name: strapi-plugin-ccsuc-meeb

    Purl: pkg:npm/strapi-plugin-ccsuc-meeb

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.6.8