strapi-plugin-portcc-meeb

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b)
Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the package `main`. On install, postinstall.js checks os.hostname() against 'ubuntu-fc-uvm' and then invokes child_process.exec on an inline python3 one-liner that opens a TCP socket to the hardcoded remote host 14.225.210.85:80, dups the socket onto stdin/stdout/stderr, and calls pty.spawn('sh'), yielding an interactive reverse shell on the installer's machine. A retry loop attempts up to five reconnects. The hostname gate is a targeting/anti-analysis check, not a safety limit. The package name and Strapi-plugin framing are a cover story; no legitimate plugin code is present.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-portcc-meeb/MAL-2026-16238.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-portcc-meeb/MAL-2026-16238.json
- https://www.npmjs.com/package/strapi-plugin-portcc-meeb/v/3.6.8
- https://github.com/advisories/GHSA-p247-8vcf-jcm5

Compromised versions (1)

• = 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.