strapi-plugin-honey-meeb

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766)
The package's postinstall lifecycle script (postinstall.js) spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP 14.225.210.85:80, dup2's stdin/stdout/stderr onto the socket, and calls pty.spawn('sh'), yielding an interactive remote shell on the installer's host at npm install time. Execution is gated by an os.hostname() check against 'ubuntu-fc-uvm', with self-labeled log strings such as '[+] Starting reverse shell' and '[+] proceeding with exploit' — a targeting/evasion pattern indicative of an intentional attack rather than a demo. The package name resembles the legitimate Strapi plugin ecosystem, but the shipped install-time payload has no legitimate purpose.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-honey-meeb/MAL-2026-16231.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-honey-meeb/MAL-2026-16231.json
- https://www.npmjs.com/package/strapi-plugin-honey-meeb/v/3.6.8
- https://github.com/advisories/GHSA-4373-h9cc-p2hr

Compromised versions (1)

• = 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.