nebulajs-api campaign: testtestkjkldfnjdfn (npm) — malicious package runs obfuscated payload on install/import (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-05
A new npm package, testtestkjkldfnjdfn, was published with malicious code and flagged by GitHub Advisory GHSA-j4mg-x22p-3q6m (MAL-2026-18697) on 2026-11-05. It ships nebula.js, byte-identical to the payload of the earlier nebulajs-api campaign (MAL-2026-17220), plus a preinstall.cjs consisting of a single opaque Function(...) call that decodes XOR-encrypted code at install time. The package poses as an ordinary utility, so the payload runs on install or import without user awareness. Only version 1.0.0 is affected and there are no patched versions; the fix is removal. Any developer or CI system that installed the package is affected. Organisations should audit lockfiles and npm install logs for the package name and version, remove it, rotate any credentials accessible from affected machines, and block the package name in registry proxies.
What to do
- Search dependency lockfiles, node_modules, and CI logs for testtestkjkldfnjdfn@1.0.0 and remove it if found
- Rotate any secrets, tokens, or credentials that could have been accessible from machines or CI runners where the package was installed
- Block the package name (and related nebulajs-api names) in npm registry proxies/allowlists and alert on future publications
- Rebuild affected environments from clean images and review for persistence or post-install artifacts
Sources
All live incidents on Threat Watch
