@emilgroup/discount-sdk (npm) · Malicious Code
Affects @emilgroup/discount-sdkSource GCVE Database
Malicious package : remove @emilgroup/discount-sdk and rotate any secrets on hosts that installed it.
Data as of 29 Oct 2026, 18:35 UTC
Malicious package
Published to npm · OSV MAL-2026-2074
What to do
Remove @emilgroup/discount-sdk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npm@emilgroup/discount-sdk | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package @emilgroup/discount-sdk was compromised by the CanisterWorm campaign attributed to the TeamPCP threat actor. Malicious versions of this package establish persistence on infected hosts via a user systemd service, install a backdoor, and harvest npm credentials. The package can autonomously spread, potentially compromising all secrets and keys on affected systems. The versions affected include 1.5.1, 1.5.2, 1.5.3, 1.14.0, and 1.14.1-beta.8. There is no evidence of installer-side harm in version 1.14.1-beta.8, but other sources confirm full compromise. No patch or remediation guidance is provided.
References
- socket.dev/blog/canisterworm-npm-publisher-compromise-deploys-backdoor-across-29-packages (opens in a new tab)
- github.com/advisories/GHSA-3fjh-jjvh-r58h (opens in a new tab)
- research.jfrog.com/post/canister-worm/ (opens in a new tab)
- endorlabs.com/learn/canisterworm (opens in a new tab)
- npmjs.com/package/@emilgroup/discount-sdk/v/1.14.0 (opens in a new tab)
- npmjs.com/package/@emilgroup/discount-sdk/v/1.14.1-beta.8 (opens in a new tab)