MAL-2026-16238

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b) Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the package `main`. On install, postinstall.js checks os.hostname() against 'ubuntu-fc-uvm' and then invokes child_process.exec on an inline python3 one-liner that opens a TCP socket to the hardcoded remote host 14.225.210.85:80, dups the socket onto stdin/stdout/stderr, and calls pty.spawn('sh'), yielding an interactive reverse shell on the installer's machine. A retry loop attempts up to five reconnects. The hostname gate is a targeting/anti-analysis check, not a safety limit. The package name and Strapi-plugin framing are a cover story; no legitimate plugin code is present.