MAL-2026-2205

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6b0abde6a2a005b2c63f18e87169a3b47ddfe6fb943ad82a005e1d3d3a8e5887)

The package @emilgroup/partner-sdk was found to contain malicious code.

Source: google-open-source-security (07ce4dc4bcadafb459b0b8e9c843204eaaa6db794788c72c45a03bd28efd5a3f)

This package was compromised by the CanisterWorm campaign by the TeamPCP threat actor. The malicious payload establishes persistence as user systemd service and places a backdoor on the infected host. The malware will also harvest npm credentials and can autonomously spread.