strapi-plugin-perev-meeb@3.6.8

Analysis

The package's postinstall hook (postinstall.js) runs a reverse shell on install. It checks the machine hostname and, if it matches 'ubuntu-fc-uvm', spawns a python3 reverse shell that connects to 14[.]225[.]210[.]85:80 and hands the remote host an interactive shell (pty.spawn("sh")), retrying up to 5 times. The hostname check is an evasion gate to avoid running in analysis environments.