strapi-plugin-listcc-meeb

GHSA-5567-73jx-f7g3

Malicious code in strapi-plugin-listcc-meeb (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0)
[email protected] declares scripts.postinstall = 'node postinstall.js' (and points main at the same file), so `npm install` auto-executes postinstall.js. That script spawns a Python one-liner via child_process that opens a socket to the hardcoded IP 14.225.210.85:80 and attaches a PTY-backed /bin/sh to the remote peer, yielding an interactive reverse shell on the installer's host. Execution is gated only by a hostname check ('ubuntu-fc-uvm'). Package metadata masquerades as a Strapi plugin ('Strapi plugin for enhanced functionality') while the repository/homepage is a placeholder github.com/user/... URL and the shipped code contains no plugin functionality — only the reverse-shell payload.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-listcc-meeb/MAL-2026-16232.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-listcc-meeb/MAL-2026-16232.json
- https://www.npmjs.com/package/strapi-plugin-listcc-meeb/v/3.6.8
- https://github.com/advisories/GHSA-5567-73jx-f7g3

Compromised versions (1)

= 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.