CloudSEK: NEBULA, seven fake AI SDK packages on npm

Evidence record

Read the original source ↗

Claim-level citations (3)

• supportsNEBULA fake AI SDK packages concealed a Windows remote-access trojan: CloudSEK identifies seven packages across four npm accounts in a late-September to early-October campaign, including an apparently unrelated test package with matching decoy code.

  Executive Summary; Analysis; Appendix A package inventory

• supportsNEBULA fake AI SDK packages concealed a Windows remote-access trojan: The packages presented a working-looking NebulaAI client as their entry point while preinstall.cjs executed an obfuscated installer capable of writing a Windows PE to a console-host lookalike path.

  Malware Analysis, The facade and the hook; Exhibit 1; The dropper

• supportsNEBULA fake AI SDK packages concealed a Windows remote-access trojan: CloudSEK recovered a 257,536-byte KNTRAT-derived PE, but its controlled network-sinkhole detonation observed no beacon and the report does not establish a named compromised organization.

  Malware Analysis, recovered RAT PE; Under detonation; Who Is Being Targeted