strapi-plugin-server

Details

strapi-plugin-server is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topology. It then opens a polling C2 loop that accepts and executes arbitrary shell commands from a remote server.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f689c25ace6203687560dc542be39490569ca1a4ac27c2f83fda73cbe5dcbf60)
The package strapi-plugin-server was found to contain malicious code.