strapi-plugin-uicc-meeb@3.6.8: Malicious npm security report

OSV Malicious Advisory

imported 25d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16191 confirms this npm version as malicious. postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname() every 3 seconds and, when the hostname matches the hardcoded value 'ubuntu-fc-uvm', spawns 'bash -i' with stdio bound to /dev/tcp/14.225.210.85/80, yielding an interactive reverse shell on the installer's host to the operator of that endpoint...

Advisory

MAL-2026-16191

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in strapi-plugin-uicc-meeb (npm)

Details

postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname() every 3 seconds and, when the hostname matches the hardcoded value 'ubuntu-fc-uvm', spawns 'bash -i' with stdio bound to /dev/tcp/14.225.210.85/80, yielding an interactive reverse shell on the installer's host to the operator of that endpoint. A long setTimeout keeps the Node process alive indefinitely after the postinstall phase, and setInterval retries the connection, providing persistence and targeted activation. The package name imitates a Strapi plugin but its shipped code performs no plugin functionality.

Decision reason

OpenSSF Malicious Packages via OSV confirms strapi-plugin-uicc-meeb@3.6.8 as malicious (MAL-2026-16191): Malicious code in strapi-plugin-uicc-meeb (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

strapi-plugin-uicc-meeb@3.6.8

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code