@emilgroup/setting-sdk

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (679e8996c56ffd334a5fd610afb087430e91e54ef7371e70ba8ce6170b3b9cf9)
The package @emilgroup/setting-sdk was found to contain malicious code.

## Source: google-open-source-security (8024c6ab9e2a90120288605aead40496c0059184b47bec681c39acf7e54c90af)
This package was compromised by the CanisterWorm campaign by the TeamPCP
threat actor. The malicious payload establishes persistence as user systemd
service and places a backdoor on the infected host. The malware will also
harvest npm credentials and can autonomously spread.

Compromised versions (3)

• 0.2.2
• 0.2.1
• 0.2.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.