36 Malicious npm Packages Exploited Redis and PostgreSQL to Deploy Persistent Implants

Cybersecurity researchers have discovered 36 malicious packages in the npm registry disguised as Strapi CMS plugins, carrying a range of payloads designed to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and drop persistent implants on compromised systems.

The packages were uploaded by four sock puppet accounts across a 13-hour window and followed the same naming convention — beginning with "strapi-plugin-" followed by terms like "cron," "database," or "server" — to deceive developers into downloading them. Official Strapi plugins are scoped under "@strapi/" and would not appear under these names.

According to researchers at SafeDep, the malicious code was embedded within the postinstall script hook, which executes automatically on "npm install" without requiring any user interaction. It runs with the same privileges as the installing user, meaning it abuses root access within CI/CD environments and Docker containers.

The campaign deployed eight distinct payload variants, each evolving over the 13-hour window — a clear indicator that the attacker was actively developing and testing against a live target. The earliest packages exploited Redis misconfigurations to achieve remote code execution, injecting cron jobs and deploying PHP web shells and Node.js reverse shells. Later variants shifted to credential harvesting, Docker container escape, and PostgreSQL database exploitation using hard-coded credentials to query tables for sensitive data including cryptocurrency wallet patterns. The final variant deployed a persistent, fileless implant — passing an entire command-and-control agent as an inline string to a detached process, leaving no filesystem trace for detection tools to find.

SafeDep analysts assessed the campaign as a targeted attack against a specific cryptocurrency platform, given the focus on digital assets, hard-coded hostname checks for "prod-strapi," and the attacker's apparent prior knowledge of the target's database structure.

This campaign sits within a broader and accelerating pattern. Group-IB's High-Tech Crime Trends Report 2026, published in February from Dubai, identified software supply chain attacks as the dominant force reshaping the global cyber threat landscape — with the GCC accounting for over 100 ransomware incidents in 2025 alone. "Package repositories such as npm and PyPI have become prime targets," the report warned, describing how attackers are turning development pipelines into large-scale distribution channels for malicious code.

Coinciding with this campaign, researchers identified several additional supply chain compromises across the open-source ecosystem — including a hijacked GitHub organisation distributing malicious trading bots, a compromised PyPI package with over one million monthly downloads, and malicious VS Code extensions with 27,500 combined installs prior to removal.

For GCC enterprise and government security teams, the practical exposure is direct. Strapi is widely used across regional digital government platforms, fintech applications, and enterprise content management deployments. Any organisation running Strapi in production should immediately audit installed npm packages against the full list of malicious package names, rotate all credentials on affected hosts — including database passwords, API keys, JWT secrets, and private keys — remove persistence artefacts including /tmp/.node_gc.js, audit crontab entries, and revoke any exposed Kubernetes service account tokens without delay.