nebulallm@1.4.3
Vulnerability report · Last retrieved from osv.dev October 26, 2026 at 12:41 AM UTC
OSV ID
MAL-2026-18297
Ecosystem
pypi
Summary
During installation package first downloads a JScript script, which then downloads the next malicious DLL. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-nebulallm Reasons (based on the campaign): - typosquatting - The package overrides the install command in setup.py to execute malicious code during installation. - Downloads and executes a remote executable. - Downloads and executes a remote malicious script. - malware
Source: kam193 (50e0ed125f08fd7743ccfb40590c24304b4731f6a99b69bc553b5bb8b7e57fc6)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.