MAL-2026-2208

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (679e8996c56ffd334a5fd610afb087430e91e54ef7371e70ba8ce6170b3b9cf9)

The package @emilgroup/setting-sdk was found to contain malicious code.

Source: google-open-source-security (8024c6ab9e2a90120288605aead40496c0059184b47bec681c39acf7e54c90af)

This package was compromised by the CanisterWorm campaign by the TeamPCP threat actor. The malicious payload establishes persistence as user systemd service and places a backdoor on the infected host. The malware will also harvest npm credentials and can autonomously spread.