The npm package nebula-llm version 1.0.0 contains a malicious preinstall script that executes a hidden Windows executable during installation. This executable impersonates a legitimate Windows system binary and acts as a persistent remote-access implant. The package installs this implant without user interaction and unrelated to any documented functionality.