36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

This article covers the discovery of 36 malicious npm packages disguised as Strapi CMS plugins that deployed persistent implants and harvested credentials.

• •All packages followed the naming convention "strapi-plugin-" and used version 3.6.8 to appear as legitimate Strapi v3 community plugins.
• •Malicious code was embedded in the postinstall script hook, executing automatically on "npm install" with the installing user's privileges.
• •Attack payloads evolved across 8 stages: Redis RCE via crontab injection, Docker container escape, reverse shell deployment, PostgreSQL exploitation using hard-coded credentials, and persistent implant installation.
• •Payloads targeted cryptocurrency-related data including wallet files, transaction records, and Guardarian API modules, suggesting a targeted attack on a cryptocurrency platform.