Skip to main content

Threat feed How it works Policy

Threat feed How it works Policy

Loading npm security reports…

Stop threats before they install.

Firewall

Threat feed
Threat types
How it works
Report methodology
Research
Policy

LPM

LPM.dev Registry
LPM CLI
LPM Vault

© 2026 LPM

@nebula.js npm scope: 4 blocked packages | LPM Firewall

npm scope

@nebula.js

LPM Firewall blocks 4 packages in the @nebula.js npm scope. 4 have LPM's own review and are listed first.

@nebula.js/sn-nav-menu@0.14.2

Credential exfiltration

The package has an unconsented preinstall chain that bootstraps a runtime solely to execute a large obfuscated, credential/network-capable payload. This is concrete malicious install-time...

@nebula.js/sn-tabbed-container@2.4.1

Remote code execution

The lifecycle script is unrelated to the advertised visualization package and deliberately bootstraps an interpreter for an obfuscated payload. Its fetched-content eval and token-oriented...

@nebula.js/sn-action-button@2.3.1

Credential exfiltration

The malicious preinstall chain executes an obfuscated payload with credential-oriented and network behavior. The legitimate bundled component code does not justify it.

@nebula.js/cli-serve@7.1.2

Remote code execution

The preinstall hook deliberately bootstraps and executes an unrelated obfuscated payload, including remote code evaluation and credential-related logic. This is concrete malicious install...

Each card opens the package page with its evidence and every recorded version.

npm threat types →Threat feed →