NEBULA: Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL

The NEBULA operation involves seven fake npm packages masquerading as NebulaAI SDKs, distributed via four burner accounts and two remaining downloadable packages. Each package contains an obfuscated installation hook that executes a customized KNTRAT variant. This RAT bypasses standard DLL imports by using direct system calls, enabling stealthy operations including hidden virtual network computing (HVNC), kernel streaming for audio/video surveillance, and persistence via Winlogon Shell. The implant communicates with a C2 server at IP 65.87.7.132 using a specific user-agent string and suppresses beaconing during analysis to evade detection.

The malware enables remote attackers to gain persistent, stealthy control over infected Windows systems, including remote desktop access, audio and video surveillance, and system persistence. This compromises confidentiality, integrity, and availability of affected systems. The supply chain vector via npm packages increases risk of widespread infection among developers and environments relying on these packages.

No official patch or remediation is indicated. Mitigation should focus on removing the malicious npm packages from projects and systems, blocking communication to the identified C2 IP (65.87.7.132) and domains (e.g., api.nebulaai.dev), and scanning for the known file hashes. Users should avoid installing npm packages from untrusted or suspicious sources and verify package authenticity before use.