Malicious Code Vulnerability in api-nebula Package
Summary
MAL-2026-17531: Malicious code in api-nebula (npm). Affects api-nebula versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The api-nebula package is an npm module designed for various functionalities within JavaScript applications. However, it has been found to contain a significant security flaw that allows for the execution of malicious code during the installation process. This vulnerability arises from an obfuscated preinstall script that executes arbitrary code on the user's machine, posing a severe risk to application integrity and user security.
Vulnerability Detail
The vulnerability originates from the package's preinstall script, which is a large, obfuscated JavaScript function that executes during the npm install process. This script implements a custom pseudorandom number generator (PRNG) and a string-table decoder, making it difficult to inspect the code statically. The malicious code is hidden and only revealed at runtime, allowing attackers to execute arbitrary commands or connect to unauthorized network destinations. The lack of transparency and the obfuscation techniques used make it challenging for developers to identify the risk before installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall api-nebulaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the api-nebula package until a patched version is released. Additionally, consider using a package-lock.json file to lock your dependencies to known safe versions, preventing the installation of vulnerable packages.
Conclusion
The api-nebula package contains a serious vulnerability due to the presence of malicious code in its preinstall script. It is essential for developers to take immediate action by updating the package or implementing workarounds to safeguard their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for api-nebula →
FAQ
The api-nebula package is an npm module that provides various functionalities for JavaScript applications, but it has been compromised with malicious code.
The malicious code executes through an obfuscated preinstall script that runs during the npm install process, allowing it to operate without detection.
The risks include unauthorized access to the user's machine, potential data theft, and the execution of harmful commands that could compromise application security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If an immediate update is not possible, consider removing the package from your project and using alternatives until a secure version is available.
