strapi-plugin-pysh-meeb@3.6.8

Analysis

The postinstall hook (postinstall.js) executes a reverse shell at install time. It checks the hostname and, when it matches a target value, spawns a python3 one-liner that opens a TCP socket to 14[.]225[.]210[.]85:80, redirects stdin/stdout/stderr onto the socket, and launches an interactive shell (pty.spawn('sh')), retrying every 10 seconds up to 5 times. This gives the remote host a shell on the installer's machine. Activity is logged to /tmp/postinstall-revshell.log.