MAL-2026-16238

    Dashboard / Malicious Package / MAL-2026-16238

    MAL-2026-16238

    Published: 16 Sept 2026Last Modified: 16 Sept 2026

    Summary: Malicious code in strapi-plugin-portcc-meeb (npm)

    Details: Source: amazon-inspector (5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b) Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the package `main`. On install, postinstall.js checks os.hostname() against 'ubuntu-fc-uvm' and then invokes child_process.exec on an inline python3 one-liner that opens a TCP socket to the hardcoded remote host 14.225.210.85:80, dups the socket onto stdin/stdout/stderr, and calls pty.spawn('sh'), yielding an interactive reverse shell on the installer's machine. A retry loop attempts up to five reconnects. The hostname gate is a targeting/anti-analysis check, not a safety limit. The package name and Strapi-plugin framing are a cover story; no legitimate plugin code is present.

    References: https://www.npmjs.com/package/strapi-plugin-portcc-meeb/v/3.6.8

    Affected packages

    Package

    Name: strapi-plugin-portcc-meeb

    Purl: pkg:npm/strapi-plugin-portcc-meeb

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    3.6.8