36 Malicious npm Packages Disguised as Strapi Plugins Exploit Redis and PostgreSQL to Deploy Persistent Implants and Reverse Shells

The 36 malicious packages demonstrate a high degree of familiarity with the Strapi CMS ecosystem and its developer community. Every package followed the same construction — three files (package.json, index.js, postinstall.js), no description, no repository link, no homepage, and a version number of 3.6.8 chosen specifically to impersonate a mature Strapi v3 community plugin. All packages followed the strapi-plugin- naming convention with phrases like "cron," "database," and "server" appended — terms that appear throughout the legitimate Strapi plugin ecosystem. The critical information security distinction that developers must know is that official Strapi plugins are scoped under @strapi/ — any unscoped strapi-plugin-* package is not from the official Strapi organisation. The packages were published by four sock puppet accounts — umarbek1233, kekylf12, tikeqemif26, and umar_bektembiev1 — over 13 hours on April 3, 2026. The choice of Strapi as the impersonation target is deliberate from a data security perspective — Strapi deployments routinely use Redis for caching and session storage, and PostgreSQL for persistent data storage, giving a successful attacker access to two high-value data stores in addition to the application server itself.

The digital security implications of this campaign extend well beyond the individual developer who runs npm install. A successful compromise of a Strapi production server gives the attacker access to the application's entire data ecosystem — the Redis cache containing session tokens and API responses, the PostgreSQL database containing user records and application data, and the container environment containing cloud provider credentials and orchestration secrets. The Guardarian database targeting is particularly notable — Guardarian is a cryptocurrency exchange platform, and the hard-coded connection attempts against six Guardarian-specific database names suggest the attacker has prior knowledge of internal Guardarian infrastructure, implying either a prior breach of Guardarian or an insider threat component. The combination of the Axios npm supply chain attack, the GlassWorm ForceMemo campaign, the React2Shell exploitation wave, and now these 36 Strapi packages represents what Mandiant CTO Charles Carmakal warned about — a cascading series of supply chain compromises whose stolen secrets will fuel further attacks over the coming months. The computer security community is dealing with a coordinated, sustained offensive against the JavaScript ecosystem's trust infrastructure.