News

Security analysts have uncovered 36 hostile packages in the npm ecosystem that masquerade as plugins for the Strapi CMS. Although they present themselves as community add-ons for Strapi v3, each package contains a hidden payload designed to exploit Redis and PostgreSQL, install remote shells, steal credentials, and persist an implant on compromised systems.

The investigator group SafeDep noted that every malicious package shares the same minimal structure: just three files - package.json, index.js, and postinstall.js - and they purposely have no description, repository link, or homepage. They all declare version 3.6.8 to give the appearance of a mature Strapi v3 community plugin.

To trick developers, the packages all use names beginning with “strapi-plugin-” followed by terms such as “cron,” “database,” or “server” to look legitimate. (By contrast, authentic Strapi plugins are published under the @strapi/ scope.) The malicious modules were pushed within a 13-hour window by four fake accounts - “umarbek1233,” “kekylf12,” “tikeqemif26,” and “umar_bektembiev1” - and include the following packages:

• strapi-plugin-cron
• strapi-plugin-config
• strapi-plugin-server
• strapi-plugin-database
• strapi-plugin-core
• strapi-plugin-hooks
• strapi-plugin-monitor
• strapi-plugin-events
• strapi-plugin-logger
• strapi-plugin-health
• strapi-plugin-sync
• strapi-plugin-seed
• strapi-plugin-locale
• strapi-plugin-form
• strapi-plugin-notify
• strapi-plugin-api
• strapi-plugin-sitemap-gen
• strapi-plugin-nordica-tools
• strapi-plugin-nordica-sync
• strapi-plugin-nordica-cms
• strapi-plugin-nordica-api
• strapi-plugin-nordica-recon
• strapi-plugin-nordica-stage
• strapi-plugin-nordica-vhost
• strapi-plugin-nordica-deep
• strapi-plugin-nordica-lite
• strapi-plugin-nordica
• strapi-plugin-finseven
• strapi-plugin-hextest
• strapi-plugin-cms-tools
• strapi-plugin-content-sync
• strapi-plugin-debug-tools
• strapi-plugin-health-check
• strapi-plugin-guardarian-ext
• strapi-plugin-advanced-uuid
• strapi-plugin-blurhash

Analysis shows the malicious logic is concealed inside the package’s postinstall hook, which executes automatically during an “npm install” without any user prompt. Because that script runs with the same permissions as the user performing the install, it can misuse elevated privileges in CI/CD pipelines and inside Docker containers to carry out its actions.

SafeDep mapped the campaign’s payloads and observed an evolution in tactics and capabilities. The abuses and stages include:

1. Leveraging a locally reachable Redis instance for remote code execution by injecting a crontab entry that downloads and runs a shell script every minute from a remote host. That script writes a PHP web shell and a Node.js reverse shell (via SSH) into Strapi’s public uploads folder, while also scanning disks for secrets such as Elasticsearch credentials and crypto wallet seed phrases and attempting to exfiltrate a Guardarian API module.

2. Combining Redis-based exploitation with techniques to escape Docker containers so shell payloads can be written to the host filesystem outside the container. This stage also spawns a Python reverse shell listening on port 4444 and places a reverse-shell trigger inside the application’s node_modules via Redis.

3. Deploying a reverse shell by writing and executing a shell downloader through Redis primitives.

4. Scanning the environment for environment variables and PostgreSQL connection strings.

5. Expanding credential theft and reconnaissance to capture environment dumps and Strapi configuration files, extract Redis data using the INFO, DBSIZE, and KEYS commands, map network topology, and harvest Docker and Kubernetes secrets, cryptographic keys, and cryptocurrency wallet files.

6. Exploiting PostgreSQL by connecting to a target database with embedded credentials and querying Strapi-specific tables to locate secrets. The actors also searched for and dumped cryptocurrency-related records (terms like wallet, transaction, deposit, withdraw, hot, cold, balance) and attempted connections to six Guardarian databases - suggesting the attacker may already possess related data from an earlier breach or other access.

7. Installing a persistent implant intended to maintain remote access to a designated hostname (“prod-strapi”).

8. Facilitating credential theft by enumerating known file paths and spawning a persistent reverse shell.

According to SafeDep, the sequence of these eight payloads reveals a clear progression: the adversary began with aggressive, automated intrusion attempts (Redis RCE and Docker escape), pivoted to reconnaissance and data collection when those methods proved less effective, used hard-coded credentials for direct database access, and ultimately focused on establishing long-term persistence and targeted credential exfiltration.

The emphasis on digital-asset related artifacts, plus the use of hard-coded DB credentials and a named hostname, suggests the campaign may have been aimed at a cryptocurrency service. SafeDep warns that organizations that installed any of the listed packages should assume they were breached and immediately rotate credentials and secrets.

This discovery arrives amid a flurry of other supply-chain compromises that have lately targeted open-source infrastructure and developer tooling. Notable incidents that surfaced around the same period include:

– A GitHub account “ezmtebo” submitting more than 256 pull requests containing a credential-exfiltration payload that steals secrets from CI logs and PR comments, injects temporary workflows to dump secret values, auto-applies labels to bypass pull_request_target protections, and runs a background /proc scanner for ten minutes after the main script finishes, according to SafeDep.

– The hijacking of the verified GitHub organization “dev-protocol” to distribute malicious Polymarket trading bots and typosquatted npm dependencies (“ts-bign” and “levex-refa” or “big-nunber” and “lint-builder”) designed to steal wallet private keys, exfiltrate sensitive files, and install an SSH backdoor. In that chain, “levex-refa” acts as a credential stealer while “lint-builder” installs the backdoor; “ts-bign” and “big-nunber” are transitive typosquat packages that deliver those stages.

– A takeover of the Emacs package “kubernetes-el/kubernetes-el” that abused a GitHub Actions pull_request_target workflow flaw (Pwn Request) to steal the repository’s GITHUB_TOKEN, exfiltrate CI/CD secrets, deface the repo, and inject destructive code that removed nearly all files.

– Compromise of the legitimate “xygeni/xygeni-action” GitHub Actions workflow via stolen maintainer credentials to plant a reverse-shell backdoor; the Xygeni maintainers have since implemented improved security controls.

– An account takeover of the npm package “mgc,” used to publish four malicious versions (1.2.1 through 1.2.4) containing a dropper that detects the OS and retrieves a platform-specific payload - a Python trojan on Linux and a PowerShell variant for Windows named WAVESHAPER.V2 - from a GitHub Gist. That campaign shares overlap with a recent supply-chain incident tied to the Axios compromise and attributed to the North Korean cluster UNC1069.

– A typosquat package “express-session-js” that impersonates “express-session” and contains a dropper fetching a second-stage remote access trojan from JSON Keeper; the payload conducts data theft and establishes persistent access by connecting to 216.126.237[.]71 via Socket.IO.

– A tampering of the PyPI package “bittensor-wallet” (version 4.0.2) to deploy a backdoor activated during wallet decryption, exfiltrating keys using HTTPS, DNS tunneling, and raw TLS to either a hard-coded domain or to domains generated daily by a DGA.

– A malicious PyPI package “pyronut” that typosquats the popular Telegram framework “pyrogram” and installs a stealth backdoor triggered on client start; the backdoor registers concealed Telegram handlers that permit two attacker-controlled accounts to run arbitrary Python code (via /e and the meval library) and arbitrary shell commands (via /shell and subprocess) on the victim host, per Endor Labs.

– Three Visual Studio Code extensions published by “IoliteLabs” - “solidity-macos,” “solidity-windows,” and “solidity-linux” - which had been dormant since 2018 but were updated to deliver a multi-stage backdoor targeting Windows and macOS at application launch to establish persistence; collectively they had about 27,500 installs before removal.

– Multiple malicious releases of the “KhangNghiem/fast-draft” VS Code extension on Open VSX (versions 0.10.89, 0.10.105, 0.10.106, and 0.10.112) that execute a GitHub-hosted downloader to fetch a Socket.IO RAT, information stealer, exfiltration module, and clipboard monitor. Notably, other versions (0.10.88, 0.10.111, and 0.10.129-135) were clean, suggesting mixed or competing release streams rather than a single compromised build, according to Aikido.

In a February 2026 report, Group-IB warned that software supply-chain attacks are now reshaping the global cyber threat landscape and have become a primary tactic for attackers. The firm observed that adversaries increasingly target trusted vendors, open-source projects, SaaS platforms, browser extensions, and managed services to gain inherited access to many downstream organizations.

Group-IB emphasized that supply-chain intrusions can rapidly magnify a local compromise into a broad, cross-border incident; by industrializing these attacks, threat actors turn supply-chain exploitation into a self-reinforcing mechanism that provides scale, speed, and stealth. “Package repositories such as npm and PyPI have become prime targets,” the report says, with stolen maintainer credentials and automated malware worms turning developer pipelines into distribution channels for malicious code.

Any teams or individuals who installed the listed Strapi-styled packages should presume their systems may be compromised: revoke and rotate all credentials, audit environments for suspicious cronjobs, web shells, and unexpected network listeners (for example on port 4444), and inspect Redis and PostgreSQL instances for unauthorized activity and unexpected data access.