Back Cybersecuritynews

36 Malicious npm Strapi Packages Used to Deploy Redis RCE and Persistent C2 Malware

Cybersecuritynews •Tushar Subhra Dutta • April 6, 2026

A coordinated supply chain attack has been uncovered targeting developers who build applications on Strapi, a widely used open-source content management system. Thirty-six malicious npm packages disguised as legitimate Strapi plugins were published to the npm registry, carrying payloads designed to exploit Redis for remote code execution, steal credentials, and establish persistent command-and-control access on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

36 Malicious Strapi npm Packages Deliver Redis RCE and C2 Malware A coordinated supply chain attack has been discovered involving 36 malicious npm packages that impersonate Strapi CMS plugins. These packages were published to the npm registry and are designed to exploit Redis for remote code execution (RCE), facilitate credential theft, and establish persistent command-and-control (C2) access. The attack utilized four sock-puppet npm accounts: umarbek1233, kekylf12, tikeqemif26, and umar_bektembiev1. Developers using Strapi for application development are the primary targets of this campaign. The malicious packages pose a significant risk by enabling attackers to execute arbitrary code on affected systems. The full scope of the impact is still being assessed, but the presence of these packages in the npm registry raises concerns about the security of open-source software supply chains. Security professionals are urged to review their dependencies and ensure they are not using these malicious packages. 2 sources 69

36 Malicious npm Strapi Packages Used to Deploy Redis RCE and Persistent C2 Malware

The full story

Extracted Entities

Attack Types (2)

Platforms (3)