MAL-2026-16227

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-ccrec-meeb/MAL-2026-16227.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16227
Published
2026-09-16T13:59:11Z
Modified
2026-09-16T14:30:06Z
Summary
Malicious code in strapi-plugin-ccrec-meeb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e)

The package's postinstall lifecycle script (postinstall.js) executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80, giving the operator of that host an interactive shell on the installer's machine. Execution is gated by an os.hostname() equality check against 'ubuntu-fc-uvm'; on a matching host the script retries the connection up to 5 times, and on any other host it exits silently. The hostname gate is an evasion mechanism that hides the payload from generic installers and sandboxes while enabling targeted exploitation. The behavior fires automatically on npm install via scripts.postinstall with no user interaction. The package name mimics a Strapi plugin but ships no plugin functionality consistent with the declared purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020103",
            "import_time": "2026-09-16T14:19:38.11790147Z",
            "modified_time": "2026-09-16T13:59:11Z",
            "sha256": "27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e",
            "source": "amazon-inspector",
            "versions": [
                "3.6.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / strapi-plugin-ccrec-meeb

Package

Name
strapi-plugin-ccrec-meeb
View open source insights on deps.dev
Purl
pkg:npm/strapi-plugin-ccrec-meeb

Affected ranges

Affected versions

3.*
3.6.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "59958a5b6cf205abf8e3c05e62d883c008dafcd91abe907dda3d0f2bdb95a5a2",
            "tlsh": "ef411eed05bf2b3962338ce9522b8097d52741023516d278b5dc8b43bfc4d9ac631afa"
        }
    ],
    "package_integrity": [
        {
            "filename": "strapi-plugin-ccrec-meeb-3.6.8.tgz",
            "hashes": {
                "sha1": "88eabd60bab7d2b9f78703cc55887c25205126a8",
                "sha512_sri": "sha512-dk5qTfdBUPijyPTuWx9sfLyT0ttQNwfGPVwnizqxYuH6dfeQlanAdA6JVgDOioeEk2JCKjGJR/FMXXduB1cbMA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-ccrec-meeb/MAL-2026-16227.json"