MalwarePublished 28 Sep 2026

nebula-sdk (npm) · Malicious Code

Affects nebula-sdkSource GCVE Database

Malicious package : remove nebula-sdk and rotate any secrets on hosts that installed it.

Data as of 29 Sep 2026, 04:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-17219

What to do

Remove nebula-sdk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnebula-sdk	Affected =1.0.0 =1.0.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package nebula-sdk versions 1.0.0 and 1.0.1 contains malicious code embedded in its preinstall lifecycle script. This script decodes and decompresses a hidden Windows executable, which is then written to the local app data directory masquerading as a legitimate system binary and executed without user interaction. The payload is linked to a remote access trojan (RAT) tool, enabling attacker-controlled native code execution on the affected Windows machine. Installation of this package results in a full compromise of the host system.

Impact

Any Windows system that installs nebula-sdk versions 1.0.0 or 1.0.1 is fully compromised, as the malicious payload executes native code with no user interaction. This can lead to complete attacker control over the system, including access to secrets and keys stored on the machine. Removal of the package does not guarantee removal of all malicious components or persistence mechanisms installed by the payload.

Defensive guidance

Immediate removal of the nebula-sdk package versions 1.0.0 and 1.0.1 is recommended. All secrets, credentials, and keys stored on the affected machine should be considered compromised and rotated from a separate, trusted system. Due to the nature of the compromise, a full system reinstallation or forensic analysis is advised to ensure complete eradication of the malicious payload and any persistence mechanisms.

Summary

The nebula-sdk npm package (versions 1.0.0 and 1.0.1) includes a preinstall.cjs lifecycle script that embeds a base64-encoded, zlib-compressed Windows PE executable (~257KB). Upon npm install, this script decodes and decompresses the payload, writes it as conhost.exe under %LOCALAPPDATA%\Microsoft\Conhost\, and executes it detached with hidden windows and no stdio, effectively running attacker-controlled native code on the Windows host without user interaction. The payload references a known RAT tool repository and an IP address associated with malicious activity. The package's advertised AI SDK functionality is unrelated to this hidden malicious payload, which is delivered through multi-layer obfuscation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Sep 2026, 04:58 UTC

Technical details

References

Community reviews