Am I affected by Malicious code in llm-nebula (npm)? What should I do?

Question

Package presents itself as an LLM SDK (nebula.js exposes a small client stub) but declares `preinstall: node preinstall.cjs` in package.json.

Affected: llm-nebula (npm) all versions. Fixed in: no fix reported yet. What should you check, and what should you do about it?

Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/mal-2026-17230-llm-nebula-npm

AgentArmorHQ team · Accepted Answer

**Am I affected?**
Affected: llm-nebula (npm) all versions. Fixed in: no fix reported yet.
- Check your version: run `npm ls llm-nebula`. Versions all versions of llm-nebula are affected.

**What to do now**
1. Remove the package if it is installed: run `npm uninstall llm-nebula`.
2. Rotate all secrets and keys stored on that computer immediately from a different computer.
3. Remove the package.

General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

**Sources**
- OSV (Open Source Vulnerabilities): https://osv.dev/MAL-2026-17230

Full incident page: https://agentarmorhq.com/incidents/2026/09/mal-2026-17230-llm-nebula-npm

Am I affected by Malicious code in llm-nebula (npm)? What should I do?

1 answer

Add your answer or comment