MAL-2026-2214

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (402f7d8c6db956de1c20cce1c23b9d2585a9210f6aae7859acb956fb66728010)

The package react-autolink-text was found to contain malicious code.

Source: google-open-source-security (fd177fa79b8a260462e6d401664042f531b87c717ab56490caf1a3d4642181c3)

This package was compromised by the CanisterWorm campaign by the TeamPCP threat actor. The malicious payload establishes persistence as user systemd service and places a backdoor on the infected host. The malware will also harvest npm credentials and can autonomously spread.