Poisoned Pipeline

Poisoned Pipeline / Incidents / AS111

AS111 · 2026-04

36 malicious Strapi plugin packages (Redis RCE / DB theft)

npm

SafeDep: thirty-six malicious npm packages from four sock-puppet
accounts (umarbek1233, kekylf12, tikeqemif26 and one more) posing as
Strapi plugins. Payload: Redis RCE, database theft, C2 agent.

Mapped techniques

supply-chain fake plugins

T0109 · Resource Development · Publish malicious artifact

36 packages, four accounts.

T0136 · Initial Access · Brandjacking

Strapi plugin impersonation.

T0118 · Execution · Command injection

Redis RCE in the payload.

Sources