Seven software packages that posed as a toolkit for an AI service were carrying a hidden Windows trojan, according to the Indian security firm CloudSEK. The malware ran the moment a developer installed one of the packages, before a single line of the supposed AI code was used, and gave an attacker the means to take over the machine.
The packages sat on npm, the public library that JavaScript developers draw on to add ready-made code to their projects. CloudSEK, which calls the campaign NEBULA, found them while scanning more than 160,000 npm packages between 25 and 27 September. They were published through four accounts named nebulallms to nebulallms4, and two of the packages, api-nebula and llm-nebula, were still available to download on 8 October.
“The package serves as the lure; the execution rests within the installation hook,” CloudSEK said in its research report.
A Convincing Front, A Hidden Script
Each package presented itself as an SDK, or software development kit, for a service called NebulaAI, the kind of library a developer adds to connect an app to an AI model. CloudSEK describes the visible code as a convincing AI client facade that points to a web address for the service, and the firm does not say whether any real NebulaAI exists behind it.
The danger sat in a small script set to run during installation, a feature npm allows so packages can prepare themselves on a new machine. Here the script was scrambled to hide what it did and dropped a program named conhost.exe into a Windows folder, borrowing the name of a genuine Windows component so it would not stand out in a list of running programs.
That program is a modified version of KNTRAT, a remote-access trojan, meaning malware that lets an attacker control a computer from afar. CloudSEK says it can run a hidden remote desktop session, execute commands and switch on the camera and microphone, and it sets itself to start again each time the user logs in. CloudSEK says it also avoids the usual Windows routes that security software watches, making it harder to spot.
CloudSEK has not confirmed that anyone was infected. When the firm ran the trojan in a test environment for 12 minutes, it never contacted its operator, which the researchers put down to checks built in to avoid analysis. The source code for KNTRAT itself was made public on 6 October.
Why Developers Are The Target
Developers make an attractive target because their machines often hold the keys to much more: access to company code, cloud accounts and the systems that build and ship software. A single compromised workstation can become a way into a corporate network, and CloudSEK flags both developer machines and the networks behind them as at risk.
The AI branding is what sets NEBULA apart from older package attacks. To a developer adding AI features to an app, an unfamiliar name such as NebulaAI looks no stranger than the many real AI startups launching tools each month. AI tools have already caused trouble for developers in other ways, with AI coding agents exposing 13,000 private screenshots in one recent case.
CloudSEK said security teams should “immediately restrict the active packages and block infrastructure associated with the campaign,” and has published the details needed to detect the trojan, including where it hides on disk and the internet address it was set to contact.
Slow To Come Down
The package api-nebula was logged as malware in a public advisory on 5 October, yet both named packages could still be installed when the research was published three days later. CloudSEK has named only two of the seven packages and has not given download figures, so the scale of any exposure is unknown.
NEBULA adds to a long run of attacks that use public code libraries to reach developers, now dressed in the language of the AI boom. With malware that runs at installation rather than at use, the packages did not need anyone to build anything with them, only to try them, which leaves the burden on registries and security teams to catch such packages before developers reach for them.
