The report
CloudSEK reported on October 8 that seven npm packages impersonating an AI software development kit carried an obfuscated installer for a Windows remote-access trojan. The packages were published through four accounts under the NEBULA campaign. The AI-specific lure was a plausible client library. The malicious behavior lay in a preinstall lifecycle hook that runs during package installation, before a developer needs to import the advertised API.
The research dossier separates the two parts. nebula.js provided a convincing model-client facade, while preinstall.cjs used obfuscated code to recover or fetch a Windows PE, write it under a console-host lookalike path and launch it. CloudSEK connected the packages through matching installer and decoy fingerprints rather than assuming similar names prove common authorship. The seventh, short-lived package served as an additional packaging pivot.
What CloudSEK observed, and what remains unknown
| Evidence | Supported conclusion | Important limit |
|---|---|---|
| Seven package names across four accounts | A coordinated distribution cluster in the observed npm sample | Seven packages do not mean seven victims |
| Recovered 257,536-byte KNTRAT-derived executable | The dropper carried a recognizable Windows RAT payload | Static capability does not prove successful remote control |
Obfuscated preinstall.cjs and a plausible SDK facade |
Installation, not ordinary AI-client use, is the execution boundary | A source reviewer may never import the decoy file |
| Isolated detonation without a beacon | The lab did not observe a connection to the command host during its test | The absence of a lab beacon does not prove the implant inert or compromised machines present |
At the October 8 report date, CloudSEK said api-nebula and llm-nebula were still downloadable. That statement is a dated observation, not verification of their present registry status. Its primary report gives package hashes, installer fingerprints and a named drop location, which are more useful for local incident triage than the campaign label alone.
The immediate control question is whether developer or CI environments execute untrusted npm lifecycle hooks with access to host files, credentials and outbound networks. Restricting those privileges changes the exposure even when a package entry point looks harmless. No named infected organization or confirmed successful live command-and-control session was established by this disclosure.