Malicious code in nebulajs-api (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (07debd960454b52639fee783e21c0c303702d8dce6de5e3320393f1b0abc7077) package.json declares scripts.preinstall = 'node preinstall.cjs'. preinstall.cjs is a single ~232KB opaque Function(...) invocation containing a custom PRNG-based string decoder (VnDKxn using constants 0x9e3779b9, 0x243f6a88, 0x6a09e667, 0x7f4a7c15) and a ciphertext table (KWlywdS) that is XOR-reconstructed at runtime via Tr8b5jD into executable code. The visible source contains no readable build logic; the entire install-time behavior is materialized from the decoded blob. This is the canonical npm install-time RCE dropper shape: an author-controlled preinstall hook whose destinations, commands, and payload are all hidden behind runtime decoding, executing on the installer's machine at `npm install` time before the user has run any package code. The shipped main module (nebula.js) is a thin AI-client wrapper hardcoding baseUrl https://api.nebulaai.dev/v2, disproportionately small compared to the obfuscated install script, and functions as a cover surface unrelated to the preinstall payload. ## Source: ghsa-malware (8e5df52f8d9581ab8db82a19ed61221cea9967ba53897bb4278838d6ef50063c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full contro
MAL-2026-17220
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17220
nebulajs-api
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "nebulajs-api",
"purl": "pkg:npm/nebulajs-api",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nebulajs-api/MAL-2026-17220.json",
"indicators": {
"evidence_files": [
{
"path": "preinstall.cjs",
"tlsh": "2c349dc7624361d5cb7241276aeffecba6c02a23966477f9b8687500f5e54c3d2e4e80",
"sha256": "a6b6ab9bd94d3e648650795806cfccc3f3fdae7e86f507895d7bbc8347b2fc06"
},
{
"path": "nebula.js",
"tlsh": "6ed1de56b57b55308eb7e390ee334009e321a26f3045862b7ffc82985f74911969afec",
"sha256": "d6b33324fdba4969820bb00f159ffb090e156760fffce1bc941bf83999690cf6"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #23571 · Revision 1
- Added to Heist Feed
- Publisher date