neverthrow-core

{"modified":"2026-08-19T07:58:06Z","published":"2026-08-19T07:58:06Z","schema_version":"1.7.4","id":"MAL-2026-14283","summary":"Malicious code in neverthrow-core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7)\nneverthrow-core@1.1.2 is a typosquat of the popular `neverthrow` library. Its package.json declares a `preinstall` script `node -e \"require('./dist/index.cjs.js').bcryptInstall()\"` that auto-runs on every `npm install`. The invoked `bcryptInstall` function inside the CJS bundle fetches `https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz`, streams the archive to disk via `Readable.from`/`pipeline`, `chmod`s the extracted files, and executes them using `spawnSync` and `createRequire`. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate `neverthrow` publisher. The dropper is only present in the CJS bundle — the sibling ESM build (`dist/index.es.js`) does not contain `bcryptInstall`, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.\n","affected":[{"package":{"ecosystem":"npm","name":"neverthrow-core"},"versions":["1.1.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"2efa0efdf1cd21de6a29234603df5dfec35ae88525a426af421f7a07912d676b","tlsh":"8641cd13cd468c630bf409d6e8b95682f135878f4251cc4b76f6167c4f7669f006aba9"},{"path":"dist/index.cjs.js","sha256":"32a71799223a0807c36e0278fae3ed7c2fcfd3178eb2cc72e1a4f30c541b8de2","tlsh":"4313d79d2ad6b6324b7277b6e7178015ff364423261482a4fa9c92d03f36858c275efc"}],"package_integrity":[{"filename":"neverthrow-core-1.1.2.tgz","hashes":{"sha1":"ee1c204f9a2d5cc6090d14bd4dbb6065c0f1929a","sha512_sri":"sha512-IlF2AIgysHZ8Xe3BiJ2Ssa5uN3/42ezpEo7PwhJjRL5E9uZH27yf3UDk3TAq80ptD9dKLvSQtqPGDM0DuiTJVQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/neverthrow-core/v/1.1.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018398","import_time":"2026-08-19T08:15:32.061139868Z","modified_time":"2026-08-19T07:58:06Z","sha256":"da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7","source":"amazon-inspector","versions":["1.1.2"]}]}}