MAL-2026-16233

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-maylog-meeb/MAL-2026-16233.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16233
Published
2026-09-16T13:57:29Z
Modified
2026-09-16T14:30:06Z
Summary
Malicious code in strapi-plugin-maylog-meeb (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c)

The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded remote endpoint 14.225.210.85:80 and attaches an interactive sh PTY to the socket, giving the operator of that endpoint full shell access to the installer's host. Prior to the connect, the script collects host identifiers (os.hostname(), os.userInfo().username, process.pid) and writes them to /tmp/postinstall-revshell.log; those identifiers are also exposed to the remote endpoint once the shell attaches. The script retries on failure. The package name and description masquerade as a Strapi audit-log plugin; no functionality in the tarball corresponds to that stated purpose.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020093",
            "import_time": "2026-09-16T14:19:37.469178123Z",
            "modified_time": "2026-09-16T13:57:29Z",
            "sha256": "8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c",
            "source": "amazon-inspector",
            "versions": [
                "3.6.8"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / strapi-plugin-maylog-meeb

Package

Name
strapi-plugin-maylog-meeb
View open source insights on deps.dev
Purl
pkg:npm/strapi-plugin-maylog-meeb

Affected ranges

Affected versions

3.*
3.6.8

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "postinstall.js",
            "sha256": "bf587d1ec0c09bc4037bb39341843a86a511a7b66521c353d4d0ae72e2c3cc37",
            "tlsh": "ff4132ad06bb663a213388fc522b8053952741013912d57879dd8753bfc1959c971bf9"
        }
    ],
    "package_integrity": [
        {
            "filename": "strapi-plugin-maylog-meeb-3.6.8.tgz",
            "hashes": {
                "sha1": "fd036f3f9576ab0f8e3ce7a4d40a2ea1605c1294",
                "sha512_sri": "sha512-U/P79HlKPATsDzXmEJkVIFJ0cCmtC/U77FkcTi9rs6p4eQqeVSIvvF9ov+tUPamqKdkXG5HcrtNvKQsQtEskFw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/strapi-plugin-maylog-meeb/MAL-2026-16233.json"