36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

Researchers discovered 36 malicious npm packages masquerading as Strapi v3 plugins that execute postinstall scripts to perform Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, exfiltrate secrets, and install persistent implants; the campaign (uploaded by multiple sock‑puppet accounts) likely targets cryptocurrency platforms and is part of a wider wave of open‑source supply chain attacks, so users who installed these packages should assume compromise and rotate credentials.