MAL-2026-16236

    Dashboard / Malicious Package / MAL-2026-16236

    MAL-2026-16236

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in strapi-plugin-perev-meeb (npm)

    Details: Source: amazon-inspector (29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700) The npm postinstall hook executes postinstall.js, which uses child_process to spawn a Python reverse shell that connects to the hardcoded remote host 14.225.210.85:80 and dup2's a PTY-backed /bin/sh over the socket, giving the operator of that host an interactive shell on the installer's machine. Execution is gated by a hostname allowlist check (os.hostname() === 'ubuntu-fc-uvm'), a target-restriction technique that keeps the payload dormant on unintended hosts (scanners, sandboxes) and only detonates on the intended victim. The package presents itself as a Strapi plugin but ships no plugin functionality relevant to the postinstall behavior; the postinstall is the payload.

    References: https://www.npmjs.com/package/strapi-plugin-perev-meeb/v/3.6.8

    Affected packages

    Package

    Name: strapi-plugin-perev-meeb

    Purl: pkg:npm/strapi-plugin-perev-meeb

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.6.8