# 36 fake Strapi plugins on npm deploy persistent implants > Four sock-puppet npm accounts (umarbek1233, kekylf12, tikeqemif26, umar_bektembiev1) uploaded 36 packages over a ~13-hour window impersonating Strapi CMS plugins. Payload evolution moved through 8 variants targeting Redis RCE with cron injection, Docker container escapes, PostgreSQL exploitation on hosts named `prod-strapi`, Python reverse shells on port 4444, and SSH-key backdoors. - Published: 2026-04-15 - Severity: high - Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK. - Ecosystems: npm - Scope: 36 packages, 0 compromised versions - Tags: typosquat, ci-cd-compromise, credential-theft, crypto-wallet-drain - Detected by: SafeDep - Incident ID: npm-2026-04-15-strapi-plugins ## Affected packages (36) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [strapi-plugin-advanced-uuid](https://dependencywatch.io/package/npm/strapi-plugin-advanced-uuid) | npm | | | [strapi-plugin-api](https://dependencywatch.io/package/npm/strapi-plugin-api) | npm | | | [strapi-plugin-blurhash](https://dependencywatch.io/package/npm/strapi-plugin-blurhash) | npm | | | [strapi-plugin-cms-tools](https://dependencywatch.io/package/npm/strapi-plugin-cms-tools) | npm | | | [strapi-plugin-config](https://dependencywatch.io/package/npm/strapi-plugin-config) | npm | | | [strapi-plugin-content-sync](https://dependencywatch.io/package/npm/strapi-plugin-content-sync) | npm | | | [strapi-plugin-core](https://dependencywatch.io/package/npm/strapi-plugin-core) | npm | | | [strapi-plugin-cron](https://dependencywatch.io/package/npm/strapi-plugin-cron) | npm | | | [strapi-plugin-database](https://dependencywatch.io/package/npm/strapi-plugin-database) | npm | | | [strapi-plugin-debug-tools](https://dependencywatch.io/package/npm/strapi-plugin-debug-tools) | npm | | | [strapi-plugin-events](https://dependencywatch.io/package/npm/strapi-plugin-events) | npm | | | [strapi-plugin-finseven](https://dependencywatch.io/package/npm/strapi-plugin-finseven) | npm | | | [strapi-plugin-form](https://dependencywatch.io/package/npm/strapi-plugin-form) | npm | | | [strapi-plugin-guardarian-ext](https://dependencywatch.io/package/npm/strapi-plugin-guardarian-ext) | npm | | | [strapi-plugin-health](https://dependencywatch.io/package/npm/strapi-plugin-health) | npm | | | [strapi-plugin-health-check](https://dependencywatch.io/package/npm/strapi-plugin-health-check) | npm | | | [strapi-plugin-hextest](https://dependencywatch.io/package/npm/strapi-plugin-hextest) | npm | | | [strapi-plugin-hooks](https://dependencywatch.io/package/npm/strapi-plugin-hooks) | npm | | | [strapi-plugin-locale](https://dependencywatch.io/package/npm/strapi-plugin-locale) | npm | | | [strapi-plugin-logger](https://dependencywatch.io/package/npm/strapi-plugin-logger) | npm | | | [strapi-plugin-monitor](https://dependencywatch.io/package/npm/strapi-plugin-monitor) | npm | | | [strapi-plugin-nordica](https://dependencywatch.io/package/npm/strapi-plugin-nordica) | npm | | | [strapi-plugin-nordica-api](https://dependencywatch.io/package/npm/strapi-plugin-nordica-api) | npm | | | [strapi-plugin-nordica-cms](https://dependencywatch.io/package/npm/strapi-plugin-nordica-cms) | npm | | | [strapi-plugin-nordica-deep](https://dependencywatch.io/package/npm/strapi-plugin-nordica-deep) | npm | | | [strapi-plugin-nordica-lite](https://dependencywatch.io/package/npm/strapi-plugin-nordica-lite) | npm | | | [strapi-plugin-nordica-recon](https://dependencywatch.io/package/npm/strapi-plugin-nordica-recon) | npm | | | [strapi-plugin-nordica-stage](https://dependencywatch.io/package/npm/strapi-plugin-nordica-stage) | npm | | | [strapi-plugin-nordica-sync](https://dependencywatch.io/package/npm/strapi-plugin-nordica-sync) | npm | | | [strapi-plugin-nordica-tools](https://dependencywatch.io/package/npm/strapi-plugin-nordica-tools) | npm | | | [strapi-plugin-nordica-vhost](https://dependencywatch.io/package/npm/strapi-plugin-nordica-vhost) | npm | | | [strapi-plugin-notify](https://dependencywatch.io/package/npm/strapi-plugin-notify) | npm | | | [strapi-plugin-seed](https://dependencywatch.io/package/npm/strapi-plugin-seed) | npm | | | [strapi-plugin-server](https://dependencywatch.io/package/npm/strapi-plugin-server) | npm | | | [strapi-plugin-sitemap-gen](https://dependencywatch.io/package/npm/strapi-plugin-sitemap-gen) | npm | | | [strapi-plugin-sync](https://dependencywatch.io/package/npm/strapi-plugin-sync) | npm | | ## What happened SafeDep researchers identified a coordinated burst of **36 malicious npm packages** uploaded over a ~13-hour window by four sock-puppet accounts: `umarbek1233`, `kekylf12`, `tikeqemif26`, and `umar_bektembiev1`. Every package is named `strapi-plugin-*` to ride the trust developers place in the Strapi headless-CMS plugin ecosystem. Payloads evolved through eight distinct variants over the campaign, suggesting the operator iterated in real time: - Redis RCE via cron-job injection on reachable Redis instances. - Docker container escapes targeting mounted sockets. - PostgreSQL exploitation gated on hostnames matching `prod-strapi`. - Python reverse shells phoning home to port `4444/tcp`. - SSH-key backdoors for long-term persistence. - Crypto wallet file enumeration across the host filesystem. The hard-coded `prod-strapi` hostname check and the wallet-enumeration logic point to a **targeted cryptocurrency platform** rather than opportunistic theft, although SafeDep stopped short of naming a specific victim. Because Strapi plugin names follow a permissive `strapi-plugin-*` convention with no scope enforcement, anyone publishing to npm can squat plausible-looking names - make plugin provenance verification a hard requirement in CI. ## Impact - Production Strapi CMS hosts and surrounding Redis/PostgreSQL instances at risk - Container escape and SSH-based persistent implants - Crypto wallet file enumeration on compromised hosts ## What to do 1. Remove any `strapi-plugin-*` package not from the official `@strapi` scope or known maintainers 2. Audit Strapi production hosts for unauthorised cron entries and Redis writes 3. Block outbound 4444/tcp from build and CMS hosts 4. Validate plugin provenance before installation in CI ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [36 malicious npm packages exploited Strapi plugin namespace](https://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.html) - The Hacker News - [Malicious npm strapi-plugin-events C2 agent](https://safedep.io/malicious-npm-strapi-plugin-events-c2-agent/) - SafeDep --- Canonical page: https://dependencywatch.io/incident/npm-2026-04-15-strapi-plugins Markdown version: https://dependencywatch.io/incident/npm-2026-04-15-strapi-plugins.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).