strapi-plugin-os-rec

GHSA-q676-3wp5-xm49

Malicious code in strapi-plugin-os-rec (npm)

Details

**Severity:** Critical

**Affected versions:** `= 3.6.8`

## Source: amazon-inspector (6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03)
postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname(), os.platform(), os.arch(), os.type(), os.release(), the current username, and enumeration of all network interface addresses — then transmits them as query-string parameters in an HTTP GET to hardcoded host 8y70jt07jkewju8wh0o1cgkaw12sqje8.oastify.com on port 80 at path /osinfo. The oastify.com subdomain is a Burp Collaborator out-of-band interaction endpoint used to receive reconnaissance beacons. The behavior is undocumented, fires on default install with no user interaction, and identifies the installing machine to an attacker-controlled listener.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-os-rec/MAL-2026-16234.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/77e1abe54c807a94ef54fde706a23385c94d9e9b/osv/malicious/npm/strapi-plugin-os-rec/MAL-2026-16234.json
- https://www.npmjs.com/package/strapi-plugin-os-rec/v/3.6.8
- https://github.com/advisories/GHSA-q676-3wp5-xm49

Compromised versions (1)

= 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.