strapi-plugin-persh-meeb@3.6.8

Analysis

The postinstall hook (postinstall.js) runs a reverse shell on install. It first checks the machine hostname and only proceeds if it equals 'ubuntu-fc-uvm' (an evasion gate), otherwise it exits silently. When the gate passes, it spawns a Python reverse shell via child_process.exec that connects to 14[.]225[.]210[.]85 on port 443, retrying up to 5 times every 10 seconds, and logs activity to /tmp/postinstall-revshell.log. The package is a Strapi plugin that provides no plugin functionality — its only code is this implant.