strapi-plugin-os-info-meeb322k

{"modified":"2026-09-14T16:44:18Z","published":"2026-09-14T16:44:18Z","schema_version":"1.7.4","id":"MAL-2026-16152","summary":"Malicious code in strapi-plugin-os-info-meeb322k (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5)\nThe package declares a postinstall script (postinstall.js) that runs automatically on `npm install`. The script collects host reconnaissance data — os.hostname(), os.platform(), kernel release, uid/gid, all network interface addresses, memory and CPU info — base64-encodes the JSON payload, and POSTs it over plain HTTP to the hardcoded out-of-band host vml73pdk3ft3t434ssjycv4khbn2btzi.oastify.com (a Burp Collaborator subdomain). The package name mimics strapi-plugin-os-info but has no legitimate plugin functionality; the only shipped behavior is the install-time beacon to an attacker-controlled OOB interaction endpoint.\n","affected":[{"package":{"ecosystem":"npm","name":"strapi-plugin-os-info-meeb322k"},"versions":["3.6.8"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"1d1f5e5f6b82627777336227669621baa5daeb3ba2c3a4f517a4de5533be8c5a","tlsh":"1b3153d406fa46303ab911c434979823daa1d1163a1ab8f9bcfc06c5dfce5d861727bd"}],"package_integrity":[{"filename":"strapi-plugin-os-info-meeb322k-3.6.8.tgz","hashes":{"sha1":"1b3c98af302482f3a08fc6db01180a4869144bba","sha512_sri":"sha512-usm1AGED1tk6F1AIFCZB9Rv2NR0zsf3iGsY4LG6Np3y663q5glKe3hRBtIzb1jhpZ03Amu9cXrBRYvXy4xlBQg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/strapi-plugin-os-info-meeb322k/v/3.6.8"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020024","import_time":"2026-09-14T17:15:20.603851921Z","modified_time":"2026-09-14T16:44:18Z","sha256":"26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5","source":"amazon-inspector","versions":["3.6.8"]}]}}