36 fake Strapi plugins on npm deploy persistent implants

What happened

SafeDep researchers identified a coordinated burst of 36 malicious npm packages uploaded over a ~13-hour window by four sock-puppet accounts: umarbek1233, kekylf12, tikeqemif26, and umar_bektembiev1. Every package is named strapi-plugin-* to ride the trust developers place in the Strapi headless-CMS plugin ecosystem.

Payloads evolved through eight distinct variants over the campaign, suggesting the operator iterated in real time:

• Redis RCE via cron-job injection on reachable Redis instances.
• Docker container escapes targeting mounted sockets.
• PostgreSQL exploitation gated on hostnames matching prod-strapi.
• Python reverse shells phoning home to port 4444/tcp.
• SSH-key backdoors for long-term persistence.
• Crypto wallet file enumeration across the host filesystem.

The hard-coded prod-strapi hostname check and the wallet-enumeration logic point to a targeted cryptocurrency platform rather than opportunistic theft, although SafeDep stopped short of naming a specific victim. Because Strapi plugin names follow a permissive strapi-plugin-* convention with no scope enforcement, anyone publishing to npm can squat plausible-looking names — make plugin provenance verification a hard requirement in CI.

Affected packages (36)

Impact

• Production Strapi CMS hosts and surrounding Redis/PostgreSQL instances at risk
• Container escape and SSH-based persistent implants
• Crypto wallet file enumeration on compromised hosts

What to do

1. 1Remove any strapi-plugin-* package not from the official @strapi scope or known maintainers
2. 2Audit Strapi production hosts for unauthorised cron entries and Redis writes
3. 3Block outbound 4444/tcp from build and CMS hosts
4. 4Validate plugin provenance before installation in CI

References

• 36 malicious npm packages exploited Strapi plugin namespace

  thehackernews.com
  The Hacker News
• Malicious npm strapi-plugin-events C2 agent

  safedep.io
  SafeDep