Supply Chain Assault: Malicious Strapi npm Packages Deliver Full System Compromise

This reveals a critical vulnerability in the npm supply chain where attackers can impersonate legitimate framework plugins to establish system compromise at scale. The sophisticated attack harvests infrastructure credentials (Kubernetes, Docker, Redis) and opens C2 sessions, making it especially dangerous for organizations running containerized Strapi deployments. The campaign's active nature and ecosystem-specific targeting suggest a sustained threat requiring immediate dependency audits across affected projects.