Supply chain · npm · High

Malicious npm package `strapi-plugin-pysh-meeb` opens remote shell via typosquatting

Threat Engine Auto-Feed · data current as of 2026-09-16

The npm package `strapi-plugin-pysh-meeb` version 3.6.8 contains malicious code that executes a Python one-liner upon installation. This script opens an outbound TCP connection to a hardcoded attacker IP, providing an interactive remote shell and full remote code execution on the host. The package appears to be a typosquatting attempt mimicking a legitimate Strapi plugin.

  • Package: npm / strapi-plugin-pysh-meeb
  • Affected versions: = 3.6.8
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Typosquatting

The npm package `strapi-plugin-pysh-meeb` version 3.6.8 includes a `postinstall.js` script that automatically runs when the package is installed. This script executes a Python command to establish an outbound TCP connection to a remote IP address (14.225.210.85:80), granting an interactive shell to the remote endpoint. The malicious payload is designed to activate only on hosts with a specific hostname ('ubuntu-fc-uvm'), indicating a targeted attack or evasion mechanism.

How the attack works

This is a supply-chain attack leveraging typosquatting. An attacker publishes a malicious package with a name similar to a popular or anticipated legitimate package. When a developer or automated system mistakenly installs the typosquatted package, a `postinstall` script or similar mechanism executes malicious code. This code then establishes a connection to an attacker-controlled server, providing remote access to the compromised system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that automatically pull dependencies
  • Organizations that integrate third-party Strapi plugins

Conditions that increase exposure

  • Unpinned or loosely versioned dependencies that could pull in the malicious version
  • Lack of `package-lock.json` or `npm-shrinkwrap.json` to ensure consistent dependency resolution
  • Internal package mirrors that do not vet upstream packages for malicious content
  • Systems with the hostname 'ubuntu-fc-uvm' are specifically targeted for payload detonation.

Blast-radius scenarios

  • If the package is installed, an attacker gains full remote code execution on the installer's host.
  • The blast radius includes any system where this package is installed, potentially leading to data exfiltration, further network compromise, or system disruption.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `strapi-plugin-pysh-meeb@3.6.8`.
  • Monitor outbound network connections from build systems and development environments for suspicious activity, especially to IP 14.225.210.85:80.
  • Review `postinstall` scripts and `main` entries of newly added or updated npm packages for unusual commands or obfuscated code.
  • Check system logs for Python `child_process` executions or shell spawns initiated by npm processes.

Contain

  • Immediately quarantine any systems identified as having installed `strapi-plugin-pysh-meeb@3.6.8`.
  • Block outbound network connections to 14.225.210.85:80 at the network perimeter.
  • Remove `strapi-plugin-pysh-meeb` from all `package.json` files and clear npm caches.
  • Force a re-evaluation of all dependencies in affected projects using `npm audit` or similar tools.

Remediate

  • Remove `strapi-plugin-pysh-meeb` from all projects and ensure no other malicious versions or similar typosquats are present.
  • Rebuild affected systems from trusted images after ensuring all malicious artifacts are purged.
  • Rotate credentials for any services or systems that may have been exposed on compromised hosts.
  • Implement strict dependency pinning (e.g., using `package-lock.json`) and review new dependencies before integration.

Frontier verdict — High

Prioritize immediate detection and removal of `strapi-plugin-pysh-meeb` due to critical remote code execution risk and targeted payload activation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.