The npm package nebula-sdk versions 1.0.0 and 1.0.1 contains malicious code embedded in its preinstall lifecycle script. This script decodes and decompresses a hidden Windows executable, which is then written to the local app data directory masquerading as a legitimate system binary and executed without user interaction. The payload is linked to a remote access trojan (RAT) tool, enabling attacker-controlled native code execution on the affected Windows machine. Installation of this package results in a full compromise of the host system.