Malicious code in testtestkjkldfnjdfn (npm)
MAL-2026-18697
Published · Modified
Dependency scanning
Check whether testtestkjkldfnjdfn is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
testtestkjkldfnjdfn ships nebula.js, byte-identical to the nebulajs-api payload, and a preinstall.cjs that is a single opaque Function(...) call decoding XOR-encrypted code at install time. It is a new name for the nebulajs-api (MAL-2026-17220) campaign; the file hashes below match that record's evidence. The package presents itself as an ordinary utility, so the code runs on import or install without the user knowing.
References
Ready to move
Start Securing
Free, no credit card | First findings in minutes