strapi-plugin-perev-meeb

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700)
The npm postinstall hook executes postinstall.js, which uses child_process to spawn a Python reverse shell that connects to the hardcoded remote host 14.225.210.85:80 and dup2's a PTY-backed /bin/sh over the socket, giving the operator of that host an interactive shell on the installer's machine. Execution is gated by a hostname allowlist check (os.hostname() === 'ubuntu-fc-uvm'), a target-restriction technique that keeps the payload dormant on unintended hosts (scanners, sandboxes) and only detonates on the intended victim. The package presents itself as a Strapi plugin but ships no plugin functionality relevant to the postinstall behavior; the postinstall is the payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-perev-meeb/MAL-2026-16236.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-perev-meeb/MAL-2026-16236.json
- https://www.npmjs.com/package/strapi-plugin-perev-meeb/v/3.6.8
- https://github.com/advisories/GHSA-293w-xgv2-3qrj

Compromised versions (1)

• = 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.