npm · Malicious package advisory
Malwareapi-nebula
GHSA-jj92-6g5g-gg78
Malicious code in api-nebula (npm)
Details
**Severity:** Critical
**Affected versions:** `= 1.0.0`
## Source: amazon-inspector (b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2)
The package declares `"preinstall": "node preinstall.cjs"` in package.json, and preinstall.cjs is a single-line ~187 KB `Function("pbeIUC", "…")` invocation implementing a custom PRNG plus string-table decoder (numeric constant table, printable-charset string table `UclPgF`, a Bob-Jenkins-style mixer, and a decoder that reconstructs strings via modular arithmetic against `UclPgF.charCodeAt(...)`). The file contains no readable logic — its entire payload is an opaque blob that is decoded and handed to the JS engine during `npm install`. String fragments visible pre-decoding (e.g. `F.kI`, `[email protected]`, `vCpP.BB/.i+gUAKa`) are placeholder-shaped and only resolve to real hosts/commands after runtime decoding, so the actual install-time behavior and any network destinations are hidden from static inspection. The wrapper module (nebula.js) and package.json declare no native build step, no compilation, and no other legitimate reason for a 187 KB obfuscated preinstall script. This is the canonical obfuscated npm preinstall dropper shape: arbitrary attacker-authored code executes on every installer's machine at `npm install` time, with intent to evade review deliberately concealed by the string-table + Function-eval loader.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/d0f91d41872db0e1e266c0023482b2ad8159a216/osv/malicious/npm/api-nebula/MAL-2026-17531.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/d0f91d41872db0e1e266c0023482b2ad8159a216/osv/malicious/npm/api-nebula/MAL-2026-17531.json
- https://www.npmjs.com/package/api-nebula/v/1.0.0
- https://github.com/advisories/GHSA-jj92-6g5g-gg78Compromised versions (1)
- = 1.0.0
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.