Which versions of strapi-plugin-pocvk are malicious?

The following npm versions of strapi-plugin-pocvk are flagged malicious: 0.0.1. Treat any of these as compromised.

How do I remediate strapi-plugin-pocvk if I installed it?

Remove strapi-plugin-pocvk from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed strapi-plugin-pocvk — how do I know if it already compromised me?

If strapi-plugin-pocvk was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is strapi-plugin-pocvk part of a known attack campaign?

Yes — strapi-plugin-pocvk is associated with the RLMA-2026-05324, RLUA-2026-06512 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find strapi-plugin-pocvk across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for strapi-plugin-pocvk (version 0.0.1).

Malicious package

strapi-plugin-pocvknpm

Advisory published Jul 7, 2026Updated Sep 1, 2026

strapi-plugin-pocvk is a confirmed malicious npm package (MAL-2026-7424) that executes malicious code on install (malicious version 0.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in strapi-plugin-pocvk (npm)

MAL-2026-7424

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall strapi-plugin-pocvk

Malicious versions

1 flagged

0.0.1

Indicators of compromise (SHA-256)

d0bc898f06b26a17d6fd7f5a44825e44c71f46420d2d4567e64a72d1c702fec3

cb02f8b3e9ca844b08ac0b8bfc1449ad55d96173aebc44014c022d1de0454f9e

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for strapi-plugin-pocvk (version 0.0.1).
If you installed it — respond
Remove strapi-plugin-pocvk from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If strapi-plugin-pocvk was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. strapi-plugin-pocvk on npm has been identified as a malicious package (version 0.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-05324RLUA-2026-06512

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks strapi-plugin-pocvk-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database