Supply Chain Attack Targets Strapi Ecosystem with 36 Malicious NPM Packages A recent supply chain attack has compromised the Strapi ecosystem, with threat actors publishing 36 malicious NPM packages across four accounts. Discovered by supply chain security firm SafeDep, the campaign delivers multiple payloads designed for Redis code execution, Docker container escape, credential harvesting, and reverse shell deployment. The attack leverages several techniques, including: - Redis exploitation to inject crontab entries, deploy PHP webshells, Node.js reverse shells, and SSH keys, while exfiltrating a Guardarian API module. - Docker container escape via overlay filesystem discovery, enabling shell deployment on host systems and credential theft from Elasticsearch and cryptocurrency wallets. - Additional payloads targeting PostgreSQL databases, wallet/key files, Strapi configurations, and persistent implants. The campaign appears tailored for Strapi users, evidenced by plugin naming conventions, targeted file paths, and environmental variables linked to Strapi’s Docker images. SafeDep’s analysis suggests the attacker initially pursued aggressive methods (Redis RCE, Docker escape) before shifting to reconnaissance, credential theft, and persistent access, with a focus on Guardarian, a cryptocurrency payment gateway. The attack primarily affects Linux systems and Strapi deployments using Redis as a cache backend. Organizations impacted by the malicious packages are at risk of credential exposure, unauthorized access, and data exfiltration.