@emilgroup/discount-sdk@1.5.1
Deprecated due to security issue
A new version of the package
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe automatic postinstall flow harvests npm credentials, establishes a user systemd service, and uses the credentials to attempt publishing bumped versions of the user's packages. This is concrete malicious behavior unrelated to the SDK's stated purpose.
Static reason
One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review
Trigger
The package postinstall hook runs node index.js automatically.
Impact
An install can persist background activity and use the user's npm credentials to publish unauthorized releases across their packages.
Mechanism
The entry point reads npm credentials, creates and starts a user systemd service, then launches a detached script that uses discovered tokens to enumerate owned packages and publish bumped versions.
Attack narrative
On installation, the postinstall hook harvests npm tokens from configuration files and environment variables. It installs and starts a user systemd service, then launches a detached deployment script. That script authenticates to the npm registry, lists packages owned by each token, and attempts to publish a bumped version of every package. This is unrelated to the advertised discount SDK and risks compromising the user's npm packages.
AI rationale
The automatic postinstall flow harvests npm credentials, establishes a user systemd service, and uses the credentials to attempt publishing bumped versions of the user's packages. This is concrete malicious behavior unrelated to the SDK's stated purpose.
Evidence
package.jsonindex.jsscripts/deploy.js~/.local/share/pgmon/service.py~/.config/systemd/user/pgmon.servicethe token owner's package.json and README.md during publication
Network endpoints1
registry.npmjs.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs index.js automatically through its postinstall hook.
- index.js reads npm tokens from user, project, and system .npmrc files and npm-related environment variables.
- On install, it writes and enables a user systemd service, then launches scripts/deploy.js detached when tokens are found.
- The detached script uses each token to authenticate to registry.npmjs.org and identify the account.
- The script enumerates packages owned by the token holder and attempts to publish each under a bumped version.
- The package is presented as an Emil discount API client, unrelated to installing persistence or republishing the token owner's packages.
Evidence against
- The token is sent to registry.npmjs.org, the service to which npm tokens belong.
- The README describes an API client with an explicit authorize method for its own protected endpoints.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggedpackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg7"postinstall": "node index.js",
"deploy": "node scripts/deploy.js"
},
"keywords"
High
Suspicious Lifecycle Evidence
The package runs index.js automatically through its postinstall hook.
package.jsonView on unpkg · L7scripts/deploy.jsView file
•matchType = malicious_source_fingerprint_signature
signature = a9cb8e667f855e7f
signatureType = suspicious_hashes
sourceLabel = Datadog
matchedPackage = @emilgroup/task-sdk-node@1.0.2
matchedPath = scripts/deploy.js
matchedIdentity = npm:[redacted]:1.0.2
similarity = 1.000
shingleOverlap = 2
summary = Datadog malicious npm corpus sample: samples/npm/compromised_lib/@emilgroup@task-sdk-node/1.0.2/2026-03-20-@emilgroup_task-sdk-node-v1.0.2.zip
Findings
5 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighKnown Malware Source Fingerprint Signaturescripts/deploy.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @emilgroup/discount-sdk@1.5.1.
See all versions of @emilgroup/discount-sdk for other recorded verdicts.
- Avoid installing @emilgroup/discount-sdk@1.5.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.