nebulaai-sdk@1.0.0

Analysis

The package's preinstall hook (preinstall.js) embeds a large base64-encoded gzip blob, decompresses it, and writes the resulting binary to %LOCALAPPDATA%\Microsoft\Conhost\conhost.exe — a hidden directory that mimics a Windows system path. It then executes that dropped binary detached and hidden (stdio ignored, windowsHide set). The package's main module (nebula.js) is a decoy AI SDK client that is not the real purpose of the package. Installing this package drops and runs an unknown binary on the host.