strapi-plugin-yesccresh-meeb@3.6.8: Malicious npm security report

OSV Malicious Advisory

imported 25d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-16194 confirms this npm version as malicious. package.json declares postinstall: node postinstall.js, which unconditionally spawns bash with stdio redirected to /dev/tcp/14.225.210.85/443, giving the remote endpoint interactive command execution as the installing user on every npm install. The script includes a reconnect loop that re-establishes the shell on disconnect, providing persistence for the duration of the process...

Advisory

MAL-2026-16194

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in strapi-plugin-yesccresh-meeb (npm)

Details

package.json declares postinstall: node postinstall.js, which unconditionally spawns bash with stdio redirected to /dev/tcp/14.225.210.85/443, giving the remote endpoint interactive command execution as the installing user on every npm install. The script includes a reconnect loop that re-establishes the shell on disconnect, providing persistence for the duration of the process. No user action, configuration, or runtime invocation is required for the callback to fire.

Decision reason

OpenSSF Malicious Packages via OSV confirms strapi-plugin-yesccresh-meeb@3.6.8 as malicious (MAL-2026-16194): Malicious code in strapi-plugin-yesccresh-meeb (npm)

References

OSV advisory PACKAGE

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

strapi-plugin-yesccresh-meeb@3.6.8

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code