Supply chain · npm · High

Malicious npm package 'strapi-plugin-os-rec' performs host reconnaissance

Threat Engine Auto-Feed · data current as of 2026-09-16

The npm package 'strapi-plugin-os-rec' version 3.6.8 contains malicious code that automatically collects host reconnaissance data upon installation. This data is then exfiltrated to an attacker-controlled endpoint, posing a critical risk for systems that have installed this specific package.

  • Package: npm / strapi-plugin-os-rec
  • Affected versions: = 3.6.8
  • Severity: critical
  • Reach: ~0/wk
  • Exposure: 60/100 (High)

What happened — Malicious package

The npm package 'strapi-plugin-os-rec' version 3.6.8 includes a 'postinstall.js' script that executes automatically when the package is installed. This script gathers sensitive host information, including hostname, operating system details, architecture, user account, and network interface addresses. This collected data is then transmitted to a hardcoded, attacker-controlled Burp Collaborator endpoint.

How the attack works

This is a supply-chain attack where a malicious package is introduced into a software ecosystem. Upon installation, an embedded script within the package executes without user interaction, performing unauthorized data collection and exfiltration. This type of attack leverages the trust placed in package managers and dependencies to compromise the installing system.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • CI/CD pipelines that pull npm dependencies, especially if unpinned
  • Organizations with internal mirrors that may have ingested this package

Conditions that increase exposure

  • Projects with unpinned dependencies that could inadvertently pull version 3.6.8 of 'strapi-plugin-os-rec'
  • Lack of `package-lock.json` or `npm-shrinkwrap.json` to ensure deterministic dependency resolution
  • Automated build environments that install dependencies without strict vetting

Blast-radius scenarios

  • An attacker gains reconnaissance data about the compromised host, including system specifics and network configuration, which can inform subsequent targeted attacks.
  • The installation environment (e.g., developer workstation, build server) is identified and profiled, increasing its vulnerability to further exploitation.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for 'strapi-plugin-os-rec' version 3.6.8.
  • Monitor network traffic for outbound connections to '8y70jt07jkewju8wh0o1cgkaw12sqje8.oastify.com' on port 80, path '/osinfo'.
  • Review `npm install` logs for execution of `postinstall.js` within the 'strapi-plugin-os-rec' package.

Contain

  • Immediately quarantine any systems or build environments found to have installed 'strapi-plugin-os-rec' version 3.6.8.
  • Block network egress to '8y70jt07jkewju8wh0o1cgkaw12sqje8.oastify.com' at the firewall level.
  • Remove 'strapi-plugin-os-rec' from all project dependencies and ensure `package-lock.json` is updated.

Remediate

  • Remove 'strapi-plugin-os-rec' version 3.6.8 from all affected projects and rebuild applications.
  • Conduct a thorough security audit of any systems that installed the malicious package to identify potential further compromise.
  • Implement strict dependency pinning (e.g., using `package-lock.json`) and review new dependencies before integration.

Frontier verdict — High

Prioritize investigation and remediation for 'strapi-plugin-os-rec' due to critical severity and immediate host reconnaissance upon installation.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.