The lure is an apparently ordinary npm client library for a fictional AI service. An installer can execute the package lifecycle script before a developer opens the JavaScript entry point. CloudSEK found that the readable SDK facade and the executable preinstall hook were materially different: the former imitates model-client methods, while the latter…
Inspect the ClaimsCase · DiggingBeagle record
NEBULA fake AI SDK packages concealed a Windows remote-access trojan
CloudSEK connected seven npm packages across four accounts to a fake AI-SDK lure and obfuscated install hooks delivering modified KNTRAT; the investigation did not establish named victim executions.
Scope
Reported finding as of 2026-10-13; publication and observation dates are distinguished in the linked source. No production exploitation is inferred without explicit evidence.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Evidence desk assessment of the pinned Claims and source provenance, checked against the public primary report or advisory. CloudSEK inspected publicly distributed npm packages and recovered a KNTRAT-derived Windows payload. Package availability is observed, but victim executions and successful C2 control were not verified. Impact remains unbanded because verified real-world affected scope and realized harm are not established. Findings are not independent reproduction by DiggingBeagle.
Assessed Oct 14, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP5-NEBULA-NPM-1 · CLM-CP5-NEBULA-NPM-2 · CLM-CP5-NEBULA-NPM-3 · CloudSEK: NEBULA, seven fake AI SDK packages on npm
At a glance
The working-looking JavaScript client facade distracts from the installation lifecycle hook that can execute before a developer imports the alleged AI SDK. The same actor reused identical hook code across multiple package names, while the payload targeted Windows and hid behind a console-host filename. A package count is not a victim count: scanning…
Read the implicationsRegistry download totals do not establish successful RAT execution. Public evidence does not establish an affected named organization or successful live command-and-control session.
Limits and uncertaintyFull account
The lure is an apparently ordinary npm client library for a fictional AI service. An installer can execute the package lifecycle script before a developer opens the JavaScript entry point. CloudSEK found that the readable SDK facade and the executable preinstall hook were materially different: the former imitates model-client methods, while the latter contains an obfuscated dropper for a Windows RAT. Repeated installer hashes link six named packages, and a seventh short-lived package offers a further packaging pivot.
The analysis recovers an executable and describes command-and-control configuration, but its isolated detonation did not observe a beacon. Code-recovered functionality and malicious packaging therefore support a supply-chain threat finding, not a proven count of infected machines. CloudSEK reports no named victim organization. The relevant security boundary is npm install-time code executing under the developer account before the supposed AI SDK is ever used.
Claims & evidence
CLM-CP5-NEBULA-NPM-1CloudSEK identifies seven packages across four npm accounts in a late-September to early-October campaign, including an apparently unrelated test package with matching decoy code.supported
Basis: reported finding
- supportsCloudSEK: NEBULA, seven fake AI SDK packages on npmprimary disclosure
Executive Summary; Analysis; Appendix A package inventory
CLM-CP5-NEBULA-NPM-2The packages presented a working-looking NebulaAI client as their entry point while preinstall.cjs executed an obfuscated installer capable of writing a Windows PE to a console-host lookalike path.supported
Basis: reported finding
- supportsCloudSEK: NEBULA, seven fake AI SDK packages on npmprimary disclosure
Malware Analysis, The facade and the hook; Exhibit 1; The dropper
CLM-CP5-NEBULA-NPM-3CloudSEK recovered a 257,536-byte KNTRAT-derived PE, but its controlled network-sinkhole detonation observed no beacon and the report does not establish a named compromised organization.supported
Basis: reported finding
- supportsCloudSEK: NEBULA, seven fake AI SDK packages on npmprimary disclosure
Malware Analysis, recovered RAT PE; Under detonation; Who Is Being Targeted
Implications
The working-looking JavaScript client facade distracts from the installation lifecycle hook that can execute before a developer imports the alleged AI SDK. The same actor reused identical hook code across multiple package names, while the payload targeted Windows and hid behind a console-host filename. A package count is not a victim count: scanning archives and observing an install hook does not show that a production host actually executed it.
Controls and mitigations
- Inspect and constrain npm lifecycle scripts, including preinstall, before accepting unfamiliar AI SDK names into developer or CI environments.
- Preserve package name, publisher account, version and lockfile digest for incident triage, and check the reported conhost drop location and host-level process provenance without assuming every Nebula-named package is malicious.
Unknowns and contradictions
- Registry download totals do not establish successful RAT execution.
- Public evidence does not establish an affected named organization or successful live command-and-control session.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 144