Malicious code in testtestkjkldfnjdfn (npm)

testtestkjkldfnjdfn ships nebula.js, byte-identical to the nebulajs-api payload, and a preinstall.cjs that is a single opaque Function... call decoding XOR-encrypted code at install time. It is a new name for the nebulajs-api MAL-2026-17220 campaign; the file hashes below match that record's...