npm: 17 Malicious 'strapi-plugin-*-meeb' and '@traktis' Packages Disclosed in Coordinated 3-Minute Burst
On September 16, 2026, 17 malicious npm packages, primarily using the `strapi-plugin-*-meeb` naming convention and `@traktis` scope, were disclosed within a tight three-minute window, indicating a highly coordinated supply chain attack.
Key findings
- 17 malicious npm packages disclosed within a 3-minute window on September 16, 2026.
- Packages primarily used
strapi-plugin-prefix with a-meebsuffix, or the@traktisnpm scope. - Malware likely exfiltrates system information and communicates with a C2 server at
oastify.com. - Post-install scripts suggest reverse shell capabilities and persistent access.
- Any system installing these packages should be considered fully compromised.
Coordinated Attack Unveils 17 Malicious npm Packages in 3 Minutes
On September 16, 2026, a coordinated disclosure event saw 17 malicious packages removed from the npm registry within a mere three-minute window. These packages, predominantly featuring the strapi-plugin- prefix and a -meeb suffix, alongside two packages under the @traktis scope, were flagged and disclosed between 13:57 UTC and 14:00 UTC, pointing to a single, concerted takedown effort by security teams.
The campaign exhibits clear naming patterns indicative of a coordinated effort. The majority of the malicious packages, 15 out of 17, adopt a strapi-plugin- prefix, suggesting an attempt to impersonate or blend in with legitimate plugins for the Strapi headless CMS. A striking commonality among these is the -meeb suffix, seen in names like strapi-plugin-ccrev-meeb, strapi-plugin-honey-meeb, and strapi-plugin-listcc-meeb. Additionally, two packages, @traktis/core and @traktis/environment, utilize the @traktis npm scope, indicating a separate but likely related vector within the same coordinated burst. This dual approach to naming conventions suggests a multi-faceted strategy by the attackers.
While specific behavioral findings for each package were not fully detailed, the extracted Indicators of Compromise (IOCs) from the advisories paint a clear picture of the malware's intent. Several IOCs, such as oastify.com, strongly suggest communication with a command-and-control (C2) server, a common tactic for exfiltrating data or receiving further instructions. Other indicators like os.arch, os.hostname, os.platform, os.release, os.type, os.userinfo, and process.pid point to the malware's capability to gather extensive system information from the infected host. The presence of postinstall-revshell.log and postinstall.js further indicates that these packages likely execute malicious scripts during the installation process, potentially establishing reverse shells to grant attackers persistent access and control over compromised systems.
The nature of these attacks, involving post-install script execution and system information exfiltration, means that any system that installed one of these malicious packages should be considered fully compromised. Such compromises typically allow attackers to gain unauthorized access, steal sensitive data, and establish persistent footholds within development environments or production systems. Users are strongly advised to treat any affected machine as untrusted and take immediate remediation steps.
Developers should immediately audit their package-lock.json files and other dependency manifests for the presence of any of the disclosed malicious packages. If found, the affected packages must be removed, and all credentials, API keys, and sensitive tokens associated with the compromised environment should be rotated from a separate, secure machine. Furthermore, organizations should review their npm token logs for any unauthorized publish events or suspicious activity around the time of the disclosure.
A representative list of the malicious packages includes:
@traktis/core@traktis/environmentstrapi-plugin-ccrev-meebstrapi-plugin-honey-meebstrapi-plugin-listcc-meebstrapi-plugin-pysh-meeb
This burst highlights the ongoing threat of supply chain attacks targeting package ecosystems like npm. The coordinated nature of this disclosure, with multiple packages dropped within minutes and exhibiting clear campaign signatures, underscores the sophisticated tactics employed by attackers. Such rapid, multi-package deployments aim to maximize the window of opportunity for compromise before detection and removal, emphasizing the critical need for continuous vigilance and robust security practices in software development.