AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by Malicious code in nebulaai-sdk (npm)? What should I do?

    The npm package nebulaai-sdk 1.0.0 hides a malicious script that runs when the package is installed.

    Affected: nebulaai-sdk 1.0.0. Fixed in: no fix reported yet. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/ghsa-57f4-h93r-jvh6-nebulaai-sdk (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: nebulaai-sdk 1.0.0. Fixed in: no fix reported yet.

      • Check your version: run npm ls nebulaai-sdk. Versions = 1.0.0 of nebulaai-sdk are affected.

      What to do now

      1. Remove the package if it is installed: run npm uninstall nebulaai-sdk.
      2. No fixed version is available yet, so there is no upgrade to make.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/ghsa-57f4-h93r-jvh6-nebulaai-sdk (opens external site)

      Did this work for you?

    Add your answer or comment