llm-nebula
This report shows the evidence for llm-nebula@1.0.0. 1 of 3 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
OpenSSF/OSV Malicious Advisory
imported 24d ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-17230 confirms this npm version as malicious.
Advisory
MAL-2026-17230
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in llm-nebula (npm)
Details
Package presents itself as an LLM SDK (nebula.js exposes a small client stub) but declares `preinstall: node preinstall.cjs` in package.json, and preinstall.cjs is a ~232KB single-line obfuscated blob that runs automatically on `npm install`. The script wraps its body in a `Function(...)` constructor and uses a custom PRNG-based string decoder (TEA/xorshift-style constants 0x9e3779b9 / 0x243f6a88 / 0x6a09e667) over a packed printable-ASCII string plus a hex-int array to reconstruct characters via `String.fromCharCode`, driving a control-flow-flattened switch dispatcher. Node builtins and method names are resolved dynamically at runtime (e.g. `Ooa8zU["Bd5Wj1"]("fs")`) so module ids, filesystem paths, network destinations, and command strings are not visible without executing the decoder. This obfuscation-plus-lifecycle-hook composition is the canonical install-time dropper / RCE shape: the benign-looking library entry serves as a cover story while the hidden preinstall payload runs on any consumer's machine at install time with the user's privileges, capable of arbitrary filesystem, process, and network operations.
References
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The automatic, opaque dynamic-code installer is a real unresolved supply-chain risk, but the inspected source does not prove a specific malicious action. Warn rather than block.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package.
Impact
The installer can perform undisclosed actions during installation; no confirmed attack surface was established by static inspection.
Mechanism
The npm preinstall hook launches a highly obfuscated script that dynamically constructs code with access to Node module loading and the global object.
AI rationale
The automatic, opaque dynamic-code installer is a real unresolved supply-chain risk, but the inspected source does not prove a specific malicious action. Warn rather than block.
Independent scan evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for AI warning decision
- The package runs preinstall.cjs automatically during installation.
- The preinstall script is a 238 KB single-line obfuscated program that invokes dynamically constructed code and exposes require and global to it.
Evidence against
- The exported client sends caller-supplied API keys only to its configured service URL; no additional suspicious runtime behavior was found in nebula.js.
- Static inspection did not establish a concrete file, network, credential, or command-execution sink within the opaque installer.
Behavioral surface
EvalNetwork
MinifiedUrlStrings
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.preinstall = node preinstall.cjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "nebula.js",
"type": "module",
"scripts": {
"preinstall": "node preinstall.cjs",
"
High
Ai Review Evidence
The package runs preinstall.cjs automatically during installation.
package.jsonView on unpkg · L5•scripts.preinstall = node preinstall.cjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpreinstall.cjsView file
1
Findings
4 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighAi Review Evidencepackage.json
HighAi Review Evidencepreinstall.cjs
HighAi Review Evidencepreinstall.cjs
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
LowScripts Present
LowEvalpreinstall.cjs
LowUrl Strings
Affected versions and remediation
This report applies to llm-nebula@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing llm-nebula@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.