MAL-2026-16231

    Dashboard / Malicious Package / MAL-2026-16231

    MAL-2026-16231

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in strapi-plugin-honey-meeb (npm)

    Details: Source: amazon-inspector (752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766) The package's postinstall lifecycle script (postinstall.js) spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP 14.225.210.85:80, dup2's stdin/stdout/stderr onto the socket, and calls pty.spawn('sh'), yielding an interactive remote shell on the installer's host at npm install time. Execution is gated by an os.hostname() check against 'ubuntu-fc-uvm', with self-labeled log strings such as '[+] Starting reverse shell' and '[+] proceeding with exploit' — a targeting/evasion pattern indicative of an intentional attack rather than a demo. The package name resembles the legitimate Strapi plugin ecosystem, but the shipped install-time payload has no legitimate purpose.

    References: https://www.npmjs.com/package/strapi-plugin-honey-meeb/v/3.6.8

    Affected packages

    Package

    Name: strapi-plugin-honey-meeb

    Purl: pkg:npm/strapi-plugin-honey-meeb

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.6.8