36 Malicious Strapi npm Packages Deliver Redis RCE, Persistent C2 Malware

A coordinated supply-chain campaign involving 36 malicious npm packages posing as Strapi plugins delivered multiple malware variants (RCE via Redis CONFIG, Docker escape attempts, bash/Python reverse shells, credential and secrets exfiltration, PostgreSQL dumps, and persistent Node.js implants) with evidence of targeting a cryptocurrency payment platform and active C2 infrastructure; package names, versions, and author accounts are enumerated as IoCs.