Malicious Code Injection in nebula-llm Package: A Critical Security Threat
Summary
MAL-2026-17227: Malicious code in nebula-llm (npm). Affects nebula-llm versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nebula-llm package is an npm library designed for various machine learning and natural language processing tasks. It is intended to facilitate the integration of language models into applications. However, the package version 1.0.0 has been found to contain a significant security vulnerability that allows for the execution of malicious code during installation, posing a severe risk to users.
Vulnerability Detail
The vulnerability originates from a preinstall lifecycle script (preinstall.cjs) included in the nebula-llm package. This script embeds a large Windows PE binary as a base64+zlib-compressed string. When a user runs 'npm install' on a Windows system, the script decompresses this binary, writes it to a location that impersonates a legitimate Windows Console Host binary, and executes it without user consent. This behavior indicates the presence of a persistent remote-access implant, which can lead to unauthorized access and control over the user's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall nebula-llmIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid installing the nebula-llm package until a secure version is released. Additionally, consider using a different package that offers similar functionality without the associated risks.
Conclusion
The nebula-llm package has a critical vulnerability that allows for the execution of malicious code during installation. Users are advised to uninstall the affected version and monitor for updates. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for nebula-llm →
FAQ
The nebula-llm package is an npm library used for machine learning and natural language processing tasks.
The vulnerability allows malicious code to be executed on your system without your consent, potentially leading to unauthorized access.
You should uninstall the nebula-llm package immediately and monitor for any updates that provide a fix.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the package-lock.json file, providing real-time alerts.
