GCVE-110-OSM-2026-12668

This package executes a heavily obfuscated 187KB preinstall hook (`preinstall.cjs`) on install using a `Function(...)` constructor pattern — a classic obfuscator.io-style eval wrapper — that decodes a multi-layer stream-cipher payload at runtime. The IOC classifier independently recovered `https://api.nebulaai.dev/v2` as a C2 endpoint via a plaintext network call in `nebula.js`, indicating the deobfuscated payload reaches out to attacker-controlled infrastructure. The publisher `nebulallms3` has a 100% malicious ratio: their only other checked package `llm-nebula` (threat_id `0447c781-24cd-45ab-bbc5-e6cfd757a978`) is already confirmed malicious in OSM, establishing a deliberate campaign pattern. The account is 2 days old with no legitimate history, and the package carries zero metadata (no description, no repository, no keywords) — a textbook burner-account staging package. The attacker model is a staged loader: obfuscated preinstall executes, decodes C2 URL, and either exfiltrates environment/credentials or fetches a secondary payload. ENTRY preinstall.cjs (install-hook: node preinstall.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 1 c2 (urls) (values recorded in verified_iocs) OBFUSCATION - Obfuscation (osm-deobfuscator): unknown in preinstall.cjs ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages