The llm-nebula npm package version 1.0.0 contains a malicious preinstall script that executes automatically during installation. This script is heavily obfuscated and runs with the user's privileges, enabling arbitrary filesystem, process, and network operations. The package pretends to be a legitimate LLM SDK but includes a runtime decoder that dynamically resolves Node.js built-in modules and commands, allowing remote code execution at install time.