# Developers Warned as Fake AI Tool Packages Spread Windows RAT Through npm Registry
A recent cybersecurity investigation has uncovered a coordinated campaign in which seven harmful software packages were uploaded to the npm registry — the world’s largest JavaScript package manager — disguised as tools for AI development. The packages, published under a carefully orchestrated sequence of disposable accounts, delivered a Windows remote-access trojan (RAT) capable of giving attackers full control over infected machines.
Researchers at CloudSEK have detailed how the operation unfolded, highlighting the growing danger of supply-chain attacks that exploit the trust developers place in publicly shared code libraries.
## How the Campaign Unfolded
The malicious operation, which CloudSEK has designated NEBULA, was launched in late September. The attacker published seven packages across four sequential accounts — named nebulallms, nebulallms2, nebulallms3, and nebulallms4 — all designed to appear legitimate.
At first glance, the packages seemed to offer a genuine software development kit for a service called NebulaAI. The main JavaScript file, nebula.js, presented itself as a client connecting to an AI service hosted at api.nebulaai.dev. This plausible façade made it difficult for developers to immediately recognize the threat.
The real danger, however, was embedded within preinstall.cjs — an obfuscated script that automatically executed during the package installation process. This hook-based approach meant that malware was deployed silently, without requiring any additional interaction from the developer beyond the initial install command.
## Technical Details of the Malware
Once triggered, the installation script wrote an executable file to a deceptive path: %LOCALAPPDATA%MicrosoftConhostconhost.exe. By naming the file after the legitimate Windows Console Host process (conhost.exe), the malware attempted to blend into normal system activity and evade casual detection.
The payload was a customized variant of KNTRAT, a Windows-based remote-access trojan configured to communicate with the IP address 65.87.7.132. The binary was delivered either as an embedded, encoded file within the package or through a network request initiated during installation.
One of the most notable technical features of the KNTRAT variant was its method of operation. Rather than relying on standard dynamic-link library (DLL) imports like most Windows applications, the malware used direct NT and win32k system calls. This approach left the Import Address Table (IAT) completely empty, a technique designed to bypass detection mechanisms that typically flag suspicious imported functions.
While this obfuscation technique does not render the malware invisible to all security tools, it significantly complicates analysis and signature-based detection.
## Capabilities of the Deployed RAT
The KNTRAT variant deployed through the NEBULA campaign carried a range of intrusive capabilities:
– **Hidden Virtual Network Computing (HVNC):** Allowed attackers to remotely control a victim’s desktop through a concealed session, making it harder for the user to notice unauthorized access.
– **Audio and Video Surveillance:** Leveraged Windows Kernel Streaming functionality to access camera and microphone feeds, enabling covert surveillance.
– **Persistence Mechanisms:** Used Winlogon Shell persistence to ensure the malware would reactivate every time the affected user logged into their machine, maintaining long-term access.
– **Command Execution:** Enabled remote attackers to execute arbitrary commands on the compromised system.
## Response and Recommendations
CloudSEK conducted a broad scan of 162,464 available npm package archives using YARA detection rules between 25th and 27th September. The scan successfully identified all seven packages linked to the campaign and generated no false positives within the examined dataset.
As of the time of reporting, two of the packages — api-nebula and llm-nebula — remained downloadable from the npm registry despite having been flagged under malware advisory MAL-2026-17531 on 5th October.
CloudSEK has called on security teams to take immediate action by blocking the identified malicious packages, restricting network communications with the associated IP address, and monitoring for the disguised executable’s installation path across their systems.
Researchers also noted that the KNTRAT source code repository was kept private during the campaign but was made public on 6th October under the name kntrat, providing additional material for further analysis.
## Limitations of the Investigation
It is important to note that CloudSEK’s investigation did not confirm any successful victim compromises. During controlled sandbox testing lasting more than 12 minutes, the recovered implant did not attempt to contact its command-and-control infrastructure. The researchers attributed this behavior to embedded anti-analysis provisions within the malware.
The absence of network activity during testing should not be interpreted as evidence that the malware is harmless or that it has not affected users. The assessment of the implant’s capabilities was based on analysis of both the recovered binary and the publicly available source code published after the campaign concluded.
—
## Frequently Asked Questions (FAQ)
**What is npm and why is it a target for attackers?**
npm is the default package manager for JavaScript and the world’s largest software registry. Because developers routinely download and install packages from npm to build applications, it represents a high-value target for attackers looking to inject malicious code into widely trusted workflows. A single compromised package can affect thousands of projects and users.
**What is a supply-chain attack?**
A supply-chain attack is a cyberattack that targets the trusted relationship between a software provider and its users. Instead of attacking an organization’s systems directly, the attacker compromises a piece of software, a library, or a tool that the target already trusts. When the compromised software is installed, the malware is delivered alongside it, often without the user’s knowledge.
**What does KNTRAT stand for and how does it work?**
KNTRAT is a Windows-based remote-access trojan that allows an attacker to take control of an infected machine. It operates by establishing a connection back to the attacker’s infrastructure, enabling remote desktop access, command execution, and data exfiltration. The variant used in the NEBULA campaign was customized to use direct system calls rather than standard library imports, making it harder to detect.
**How can developers protect themselves from malicious npm packages?**
Developers can reduce their risk by verifying the reputation and maintainer history of packages before installing them, using dependency scanning tools, monitoring for security advisories, and limiting the permissions granted to installed packages. Organizations should also enforce policies that restrict the use of unverified or newly published packages in production environments.
**What should organizations do if they suspect infection?**
Organizations should immediately search their systems for the disguised executable at the known installation path, block network traffic to the associated IP address (65.87.7.132), remove any identified malicious packages, and conduct a thorough review of affected developer workstations. Security teams should also monitor for indicators of persistence, such as unusual entries in Windows logon settings.
**Are there tools that can automatically detect packages like these?**
Yes, automated scanning tools using YARA rules, static analysis, and behavioral detection can help identify suspicious packages. CloudSEK’s scan of over 162,000 npm archives demonstrated that such tools can effectively flag malicious packages with minimal false positives. Integrating these tools into CI/CD pipelines adds an important layer of defense.
—
## Conclusion
The NEBULA campaign serves as a stark reminder that the convenience of open-source software ecosystems comes with inherent security risks. Attackers are increasingly targeting developer toolchains, banking on the trust that communities place in widely used package registries. By disguising malware as legitimate AI development tools, the operator behind NEBULA exploited a genuine demand for AI infrastructure, making the threat both plausible and dangerous.
For developers and organizations alike, vigilance is essential. Implementing robust dependency management practices, staying informed about security advisories, and deploying automated scanning tools are critical steps in defending against the evolving tactics of supply-chain attackers. The fact that two of the identified packages remained downloadable at the time of reporting underscores the need for faster response times from platform operators and the security community working together.
Thank you for reading
