MalwarePublished 25 Oct 2026

nebulallm (PyPI) · Malicious Code

Affects nebulallmSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
PyPInebulallm	Affected =1.4.3	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The nebulallm package on PyPI version 1.4.3 is a malicious typosquatting package that executes harmful code during installation. It overrides the install command in setup.py to download and run a JScript script, which subsequently downloads a malicious DLL. This behavior clearly indicates malware intent.

Impact

Installation of nebulallm version 1.4.3 results in execution of remote malicious code, including a JScript script and a DLL, potentially leading to system compromise or data theft. The package's behavior is consistent with malware, posing a high risk to affected systems.

Defensive guidance

Do not install the nebulallm package version 1.4.3 from PyPI. Remove any installations of this package immediately. Use trusted sources and verify package authenticity before installation.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 25 Oct 2026, 22:29 UTC

Technical details

References

Community reviews