Malicious code in api-nebula (npm)

The 'api-nebula' npm package version 1.0.0 includes a large (~187 KB) obfuscated preinstall script executed during 'npm install'. This script uses a custom PRNG and string-table decoder to hide its payload, which is dynamically reconstructed and executed via JavaScript's Function constructor. The obfuscation conceals network hosts and commands, preventing static inspection. The package has no legitimate reason for such a large obfuscated preinstall script, indicating it is a malicious dropper that executes arbitrary attacker code on every installation, compromising the host system.

Any system that installs 'api-nebula' version 1.0.0 is at risk of full compromise due to arbitrary code execution during package installation. This can lead to unauthorized access, data theft, and persistent backdoors. All secrets and keys stored on the compromised machine should be considered exposed and must be rotated immediately. Removing the package alone may not fully remediate the compromise, as the attacker may have installed additional malware.

Remove the 'api-nebula' package version 1.0.0 immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored or used on compromised machines from a separate, trusted environment. Due to the potential full system compromise, consider rebuilding affected systems from known good backups or reinstalling the operating system. Monitor for any signs of persistent malicious activity. Patch status is not applicable as this is a malicious package rather than a vulnerability with a vendor fix.