neverthrow-js

{"modified":"2026-08-10T12:32:39Z","published":"2026-08-10T12:32:39Z","schema_version":"1.7.4","id":"MAL-2026-13706","summary":"Malicious code in neverthrow-js (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd)\nPackage neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path /wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) so the literal C2 URL never appears in source. It fetches a response, base64-decodes the body, and executes it via new Function(\"rq\", parsed); nfu(require)(), passing require into the evaluated code so the remote payload has full Node capability on the installer's host. Execution is gated by a Date check for 2026-08-11 02:00:00 GMT. index.cjs.js reproduces the real neverthrow library to provide cover for the malicious install hook.\n","affected":[{"package":{"ecosystem":"npm","name":"neverthrow-js"},"versions":["2.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/install.js","sha256":"7a6c6da6ab8f39e08445dba37cd5e5435b39468a3e192c38771e9d824ff195fd","tlsh":"9f51e0945136640787f1fbb4eb130859faeb56632200c298b9dc45802f7b97893b7dde"}],"package_integrity":[{"filename":"neverthrow-js-2.0.0.tgz","hashes":{"sha1":"16372f4b75561c88775d5fd8612daa1ecb10fa08","sha512_sri":"sha512-Wn+VcdCQ5XXhNodBXzcDDMODdOeKacobmJ67qbupBP3QHjR/ifX5zDnS7nxj4UxLFyTQ8P61NTs6+P+/3XiUhg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/neverthrow-js/v/2.0.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017272","import_time":"2026-08-10T12:51:45.354323959Z","modified_time":"2026-08-10T12:32:39Z","sha256":"2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd","source":"amazon-inspector","versions":["2.0.0"]}]}}