MAL-2026-2205
See a problem?- Import Source
- https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@emilgroup/partner-sdk/MAL-2026-2205.json
- JSON Data
- https://api.osv.dev/v1/vulns/MAL-2026-2205
- Published
- 2026-03-26T00:33:27Z
- Modified
- 2026-03-31T03:23:24.550129Z
- Summary
- Malicious code in @emilgroup/partner-sdk (npm)
- Details
-
-= Per source details. Do not edit below this line.=-
Source: amazon-inspector (6b0abde6a2a005b2c63f18e87169a3b47ddfe6fb943ad82a005e1d3d3a8e5887)
The package @emilgroup/partner-sdk was found to contain malicious code.
Source: google-open-source-security (07ce4dc4bcadafb459b0b8e9c843204eaaa6db794788c72c45a03bd28efd5a3f)
This package was compromised by the CanisterWorm campaign by the TeamPCP threat actor. The malicious payload establishes persistence as user systemd service and places a backdoor on the infected host. The malware will also harvest npm credentials and can autonomously spread.
- Database specific
{ "iocs": { "urls": [ "https://tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io/" ], "domains": [ "litellm.cloud" ] }, "malicious-packages-origins": [ { "import_time": "2026-03-26T00:34:45.43113Z", "sha256": "07ce4dc4bcadafb459b0b8e9c843204eaaa6db794788c72c45a03bd28efd5a3f", "source": "google-open-source-security", "modified_time": "2026-03-26T00:33:27Z", "versions": [ "1.19.1", "1.19.2", "1.19.3" ] }, { "import_time": "2026-03-31T03:10:15.082063748Z", "sha256": "6b0abde6a2a005b2c63f18e87169a3b47ddfe6fb943ad82a005e1d3d3a8e5887", "source": "amazon-inspector", "modified_time": "2026-03-31T02:07:58Z", "versions": [ "1.19.1", "1.19.2", "1.19.3" ] } ] }- References
- Credits
-
-
- Amazon Inspector - FINDER
-
Affected packages
npm / @emilgroup/partner-sdk
Package
- Name
- @emilgroup/partner-sdk
- View open source insights on deps.dev
- Purl
- pkg:npm/%40emilgroup/partner-sdk