The nebulajs-api npm package (version 1.0.0) includes a malicious preinstall hook implemented as an obfuscated ~232KB script that decodes and executes a hidden payload at npm install time. This payload uses a custom pseudo-random number generator and XOR-based decoding to reconstruct executable code, enabling remote code execution on the installer's machine. The legitimate main module is minimal and unrelated to the malicious behavior, indicating the preinstall script is the primary attack vector. This pattern is a canonical npm install-time RCE dropper, allowing an attacker to gain full control of the compromised system.

Any system that installs nebulajs-api version 1.0.0 is fully compromised due to the remote code execution capability of the preinstall script. Attackers may gain complete control over the affected machine, potentially accessing or exfiltrating all secrets and keys stored on it. Removal of the package does not guarantee elimination of all malicious artifacts, as the attacker may have established persistent backdoors or additional malware.

Immediate removal of the nebulajs-api package version 1.0.0 from all systems is recommended. All secrets and keys stored on compromised machines should be rotated from a separate, trusted device. Because the preinstall script executes code at install time, avoid installing this package altogether. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.