Skip to content
Heist/ feed
Unrated

Malicious code in nebulajs-api (npm)

Type: advisorySource: OSV1 source record

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (07debd960454b52639fee783e21c0c303702d8dce6de5e3320393f1b0abc7077) package.json declares scripts.preinstall = 'node preinstall.cjs'. preinstall.cjs is a single ~232KB opaque Function(...) invocation containing a custom PRNG-based string decoder (VnDKxn using constants 0x9e3779b9, 0x243f6a88, 0x6a09e667, 0x7f4a7c15) and a ciphertext table (KWlywdS) that is XOR-reconstructed at runtime via Tr8b5jD into executable code. The visible source contains no readable build logic; the entire install-time behavior is materialized from the decoded blob. This is the canonical npm install-time RCE dropper shape: an author-controlled preinstall hook whose destinations, commands, and payload are all hidden behind runtime decoding, executing on the installer's machine at `npm install` time before the user has run any package code. The shipped main module (nebula.js) is a thin AI-client wrapper hardcoding baseUrl https://api.nebulaai.dev/v2, disproportionately small compared to the obfuscated install script, and functions as a cover surface unrelated to the preinstall payload. ## Source: ghsa-malware (8e5df52f8d9581ab8db82a19ed61221cea9967ba53897bb4278838d6ef50063c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full contro

Announced Source revision 1
Original source ↗

MAL-2026-17220

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:MAL-2026-17220

nebulajs-api

Source reference: /affected/0/package/name

Affected versions
1.0.0

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "SEMVER",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "nebulajs-api",
      "purl": "pkg:npm/nebulajs-api",
      "ecosystem": "npm"
    },
    "versions": [
      "1.0.0"
    ],
    "database_specific": {
      "cwes": [
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        },
        {
          "name": "Embedded Malicious Code",
          "cweId": "CWE-506",
          "description": "The product contains code that appears to be malicious in nature."
        }
      ],
      "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nebulajs-api/MAL-2026-17220.json",
      "indicators": {
        "evidence_files": [
          {
            "path": "preinstall.cjs",
            "tlsh": "2c349dc7624361d5cb7241276aeffecba6c02a23966477f9b8687500f5e54c3d2e4e80",
            "sha256": "a6b6ab9bd94d3e648650795806cfccc3f3fdae7e86f507895d7bbc8347b2fc06"
          },
          {
            "path": "nebula.js",
            "tlsh": "6ed1de56b57b55308eb7e390ee334009e321a26f3045862b7ffc82985f74911969afec",
            "sha256": "d6b33324fdba4969820bb00f159ffb090e156760fffce1bc941bf83999690cf6"
          }
        ]
      }
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#23571 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement