MAL-2026-16231

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766) The package's postinstall lifecycle script (postinstall.js) spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP 14.225.210.85:80, dup2's stdin/stdout/stderr onto the socket, and calls pty.spawn('sh'), yielding an interactive remote shell on the installer's host at npm install time. Execution is gated by an os.hostname() check against 'ubuntu-fc-uvm', with self-labeled log strings such as '[+] Starting reverse shell' and '[+] proceeding with exploit' — a targeting/evasion pattern indicative of an intentional attack rather than a demo. The package name resembles the legitimate Strapi plugin ecosystem, but the shipped install-time payload has no legitimate purpose.