strapi-plugin-os-info-meeb322k

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5)
The package declares a postinstall script (postinstall.js) that runs automatically on `npm install`. The script collects host reconnaissance data — os.hostname(), os.platform(), kernel release, uid/gid, all network interface addresses, memory and CPU info — base64-encodes the JSON payload, and POSTs it over plain HTTP to the hardcoded out-of-band host vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com (a Burp Collaborator subdomain). The package name mimics strapi-plugin-os-info but has no legitimate plugin functionality; the only shipped behavior is the install-time beacon to an attacker-controlled OOB interaction endpoint.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/strapi-plugin-os-info-meeb322k/MAL-2026-16152.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/c84d6ff0e4a864f0926f41430c4478a4c99e4108/osv/malicious/npm/strapi-plugin-os-info-meeb322k/MAL-2026-16152.json
- https://www.npmjs.com/package/strapi-plugin-os-info-meeb322k/v/3.6.8
- https://github.com/advisories/GHSA-3jh2-p873-gc7r

Compromised versions (1)

• = 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.