The nebulaai-sdk npm package version 1.0.0 includes a preinstall script that decodes a base64 and zlib compressed 257 KB Windows PE executable. Upon npm install on Windows, this executable is written to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe, mimicking a legitimate Windows system binary. The script then silently spawns this executable with parameters that hide its execution and allow it to persist beyond the npm process. The embedded executable contains a section named .kntrat and references an external IP address (65.87.7.132) and a GitHub repository associated with remote access trojan functionality, indicating it acts as a RAT. The package itself has no legitimate SDK features and is designed purely to stage and execute this malicious payload, enabling full arbitrary code execution under the installing user's privileges.

Installing nebulaai-sdk version 1.0.0 on a Windows system results in silent execution of a malicious binary that masquerades as a legitimate Windows process. This binary establishes a remote command-and-control channel, allowing attackers to execute arbitrary commands and maintain persistence on the affected system. The compromise occurs with the privileges of the installing user, potentially leading to full system compromise depending on user rights.

No official patch or remediation is currently documented. Users and administrators should avoid installing nebulaai-sdk version 1.0.0 from untrusted sources. Remove the package if already installed on Windows systems and delete the staged executable at %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe. Monitor for suspicious processes matching this path and network connections to the IP 65.87.7.132. Check vendor advisories or npm security notices for updates or official guidance.