malware
npm
@nebula.js/stardust
discovered 2026-08-04Nebula.js stardust. Representative of ~22 compromised @nebula.js packages. Compromised via qlikossbuild account. Variant B payload.
Threat types
credential_stealer worm persistence
Malicious versions
- 7.1.2
