Malicious code in strapi-plugin-listcc-meeb (npm)
Historical advisory saved 24 Oct 2026 13:17:17 UTC. The publisher may have updated it since then. Latest advisory.
osv · MAL-2026-16232
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0) [email protected] declares scripts.postinstall = 'node postinstall.js' (and points main at the same file), so `npm install` auto-executes postinstall.js. That script spawns a Python one-liner via child_process that opens a socket to the hardcoded IP 14.225.210.85:80 and attaches a PTY-backed /bin/sh to the remote peer, yielding an interactive reverse shell on the installer's host. Execution is gated only by a hostname check ('ubuntu-fc-uvm'). Package metadata masquerades as a Strapi plugin ('Strapi plugin for enhanced functionality') while the repository/homepage is a placeholder github.com/user/... URL and the shipped code contains no plugin functionality — only the reverse-shell payload.
- Source published
- 16 Sep 2026 13:57:20 UTC
- Source modified
- 16 Sep 2026 14:30:06 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.