testtestkjkldfnjdfn

Details

testtestkjkldfnjdfn ships nebula.js, byte-identical to the nebulajs-api payload, and a preinstall.cjs that is a single opaque Function(...) call decoding XOR-encrypted code at install time. It is a new name for the nebulajs-api (MAL-2026-17220) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.

Compromised versions (1)

• 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.