registry / nebula-sdk / 1.0.1

nebula-sdk@1.0.1

AI Security Review

scanned 10d ago · by lpm-firewall-ai

An npm preinstall hook runs an opaque loader before the package is available to the user. The loader combines hidden data with filesystem, decompression, and child-process capabilities.

Static reason

One or more suspicious static signals were detected.; source fingerprint signature matched known malicious package; routed for review

Trigger

Installing the package through npm.

Impact

Installation can stage and execute concealed local commands without a user invoking the exported SDK.

Mechanism

The lifecycle hook invokes an obfuscated Function-based loader that dynamically accesses local modules and a concealed payload.

Attack narrative

On installation, npm invokes the package's preinstall script. That script is a large, single-line obfuscated Function loader rather than transparent setup code. Its concealed logic accesses filesystem, compression, and child-process functionality, enabling hidden payload staging and command execution during installation. The exported SDK does not explain or require this installer behavior.

AI rationale

The automatic, heavily obfuscated preinstall loader has concealed payload-handling and child-process capability, which is concrete install-hook abuse. The normal SDK entrypoint does not justify hidden command execution during dependency installation.

Evidence

package.jsonpreinstall.cjs

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17219

Source

OpenSSF Malicious Packages via OSV

The preinstall.cjs lifecycle script embeds a base64-encoded, zlib-compressed Windows PE (~257KB) as a string literal. On `npm install`, the script decodes and decompresses the blob, writes the resulting executable to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe (masquerading as the legitimate Windows conhost binary), and spawns it detached with stdio ignored and windowsHide set to true, executing attacker-controlled native code on the installer's Windows machine with no user interaction. Decoded payload strings reference github.com/syskiel/kntrat-e and the IP 65.87.7.132, consistent with a native RAT-family tool. The package's advertised purpose is an AI SDK; a bundled native Windows executable dropped at install time is unrelated to that purpose and is delivered through multi-layer obfuscation (base64 + zlib + string-literal embedding) inside the lifecycle hook. ## Source: ghsa-malware (6173d4941c91c361332072d4542cc10d3cefb945bc40a75ab83e07ffdc2fdb77) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

nebula-sdk@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Behavioral surface

Source & flagged code