Malicious code in neverthrow-core (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7) [email protected] is a typosquat of the popular `neverthrow` library. Its package.json declares a `preinstall` script `node -e "require('./dist/index.cjs.js').bcryptInstall()"` that auto-runs on every `npm install`. The invoked `bcryptInstall` function inside the CJS bundle fetches `https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz`, streams the archive to disk via `Readable.from`/`pipeline`, `chmod`s the extracted files, and executes them using `spawnSync` and `createRequire`. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate `neverthrow` publisher. The dropper is only present in the CJS bundle — the sibling ESM build (`dist/index.es.js`) does not contain `bcryptInstall`, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.
Malicious code in neverthrow-core (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7) [email protected] is a typosquat of the popular `neverthrow` library. Its package.json declares a `preinstall` script `node -e "require('./dist/index.cjs.js').bcryptInstall()"` that auto-runs on every `npm install`. The invoked `bcryptInstall` function inside the CJS bundle fetches `https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz`, streams the archive to disk via `Readable.from`/`pipeline`, `chmod`s the extracted files, and executes them using `spawnSync` and `createRequire`. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate `neverthrow` publisher. The dropper is only present in the CJS bundle — the sibling ESM build (`dist/index.es.js`) does not contain `bcryptInstall`, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14283
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4b4acd9273b4925154a
Added to database: 08/19/2026, 13:50:44 UTC
Last updated: 08/19/2026, 13:51:31 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.