OTX Threat: NEBULA: Seven Fake AI SDK Packages on npm Install a Windows RAT That Needs No DLL

In late September 2026, an actor deployed seven malicious npm packages masquerading as a NebulaAI software development kit to deliver a Windows remote-access trojan. The operation, tracked as NEBULA, spans four sequential burner accounts (nebulallms through nebulallms4), with api-nebula and llm-nebula remaining downloadable. Each package presents a convincing AI client facade while hiding an obfus