npm: 19 Malicious Packages with `strapi-plugin-*-meeb` Pattern Disclosed in Coordinated 43-Minute Drop

Key findings

• 19 malicious npm packages were disclosed on September 16, 2026.
• The disclosure occurred within a tight 43-minute window, indicating a coordinated takedown.
• Many packages share the strapi-plugin-*-meeb naming pattern, suggesting a campaign signature.
• Two packages under the @traktis/ scope were also part of this burst.
• One package, idx_form_script, was flagged for communicating with a malicious domain.
• All 18 GHSA advisories were rated Critical severity.

Coordinated Malicious Package Disclosure on npm

On September 16, 2026, a coordinated disclosure event on npm saw 19 malicious packages flagged and removed from the registry within a tight 43-minute window, from 15:30 UTC to 16:13 UTC. This rapid succession of advisories points to a single, concerted takedown effort by security teams targeting a specific campaign.

Campaign Signature: strapi-plugin-*-meeb and @traktis Scope

The vast majority of the disclosed packages exhibit a clear campaign signature: a strapi-plugin- prefix combined with a -meeb suffix. This naming convention suggests an attempt to impersonate legitimate Strapi plugins or to create a themed set of malicious packages. Examples of packages following this pattern include:

• strapi-plugin-perev-meeb
• strapi-plugin-pysh-meeb
• strapi-plugin-honey-meeb
• strapi-plugin-feedmeeb
• strapi-plugin-ccrev-meeb

In addition to the strapi-plugin-*-meeb family, two packages, @traktis/environment and @traktis/core, were also disclosed in this burst, indicating a potential broader scope for the campaign or a separate but co-timed attack vector. Another package, idx_form_script, and process-mite were also part of this coordinated drop.

Malicious Behavior and Critical Severity

Behavioral analysis, where available, indicates that at least one package, idx_form_script, was designed to communicate with a domain associated with malicious activity. While specific details on the nature of this communication were not provided, such behavior typically involves command-and-control (C2) communication, data exfiltration, or the downloading of additional malicious payloads. The presence of such network activity is a strong indicator of compromise.

All 18 advisories originating from GitHub Security Advisories (GHSA) were assigned a Critical severity rating. This designation signifies that any system that installed these packages should be considered fully compromised. The implications of such a compromise are severe, potentially leading to unauthorized access, data theft, or the execution of arbitrary code on affected systems.

Detection and Response for Developers

Developers are strongly advised to audit their package-lock.json, yarn.lock, or pnpm-lock.yaml files for the presence of any of the malicious package names disclosed in this burst. If any of these packages are found, immediate action is required:

• Isolate affected systems: Disconnect any compromised development or production environments from the network.
• Rotate credentials: Assume all secrets, API keys, and access tokens used within the affected environment are compromised. Rotate them immediately from a separate, secure machine.
• Check npm token logs: Review npm audit logs for any unauthorized package publishes or suspicious activity associated with your accounts.
• Remove malicious packages: Thoroughly remove the malicious packages and their dependencies from your projects.

Some of the key package names to look for include: strapi-plugin-perev-meeb, strapi-plugin-pysh-meeb, strapi-plugin-honey-meeb, strapi-plugin-feedmeeb, strapi-plugin-ccrev-meeb, @traktis/environment, @traktis/core, idx_form_script, and process-mite.

Broader Context of Supply Chain Attacks

This coordinated disclosure highlights the ongoing threat of software supply chain attacks, particularly within popular package ecosystems like npm. Attackers frequently leverage common naming patterns, typosquatting, or the impersonation of legitimate projects to distribute malicious code. The rapid, coordinated nature of this disclosure suggests an active monitoring and response effort by security researchers and registry maintainers to combat these persistent threats.