MAL-2026-16238 Malicious code in strapi-plugin-portcc-meeb (npm)

Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the package main. On install, postinstall.js checks os.hostname() against 'ubuntu-fc-uvm' and then invokes child_process.exec on an inline python3 one-liner that opens a TCP socket to the hardcoded remote host 14.225.210.85:80, dups the socket onto stdin/stdout/stderr, and calls pty.spawn('sh'), yielding an interactive reverse shell on the installer's machine. A retry loop attempts up to five reconnects. The hostname gate is a targeting/anti-analysis check, not a safety limit. The package name and Strapi-plugin framing are a cover story; no legitimate plugin code is present.