Am I affected by Malware in llm-nebula? What should I do?

Question

The npm package llm-nebula contains malware.

Affected: llm-nebula >= 0. Fixed in: no fix reported yet. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/10/ghsa-w7wp-5j6j-rgg5-npm

AgentArmor team · Accepted Answer

**Am I affected?**
Affected: llm-nebula >= 0. Fixed in: no fix reported yet.
- Check your version: run `npm ls llm-nebula`. Versions >= 0 of llm-nebula are affected.

**What to do now**
1. Remove the package if it is installed: run `npm uninstall llm-nebula`.
2. Rotate all secrets and keys stored on that computer from a different computer.
3. Remove the package from the computer.
4. Removing the package may not remove all malicious software, so the computer may still be compromised.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- GitHub Advisory Database: https://github.com/advisories/GHSA-w7wp-5j6j-rgg5

Full incident page: https://agentarmorhq.com/incidents/2026/10/ghsa-w7wp-5j6j-rgg5-npm

Am I affected by Malware in llm-nebula? What should I do?

1 answer

Add your answer or comment