strapi-plugin-perev-meeb

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700)
The npm postinstall hook executes postinstall.js, which uses child_process to spawn a Python reverse shell that connects to the hardcoded remote host 14.225.210.85:80 and dup2's a PTY-backed /bin/sh over the socket, giving the operator of that host an interactive shell on the installer's machine. Execution is gated by a hostname allowlist check (os.hostname() === 'ubuntu-fc-uvm'), a target-restriction technique that keeps the payload dormant on unintended hosts (scanners, sandboxes) and only detonates on the intended victim. The package presents itself as a Strapi plugin but ships no plugin functionality relevant to the postinstall behavior; the postinstall is the payload.

Compromised versions (1)

• 3.6.8

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.