The npm package @emilgroup/discount-sdk was compromised by the CanisterWorm campaign attributed to the TeamPCP threat actor. Malicious versions of this package establish persistence on infected hosts via a user systemd service, install a backdoor, and harvest npm credentials. The package can autonomously spread, potentially compromising all secrets and keys on affected systems. The versions affected include 1.5.1, 1.5.2, 1.5.3, 1.14.0, and 1.14.1-beta.8. There is no evidence of installer-side harm in version 1.14.1-beta.8, but other sources confirm full compromise. No patch or remediation guidance is provided.