The nebulaai-sdk npm package version 1.0.0 contains malicious code that executes a hidden Windows executable during installation on Windows systems. This executable is disguised as a legitimate Windows console host binary and establishes a remote command-and-control connection. The package lacks legitimate SDK functionality and solely serves to deploy and run this malicious payload, resulting in arbitrary code execution under the installing user's context.