Malicious code in neverthrow-core (npm)

[email protected] is a typosquatting npm package mimicking the popular neverthrow library. Its package.json defines a preinstall script that runs a function named bcryptInstall from the CommonJS bundle. This function downloads a tarball from an anonymous and mutable Dropbox link, extracts it, changes permissions, and executes the files without any signature or hash verification. The malicious payload is concealed in the CJS build and absent from the ESM build, hiding it from users inspecting the ESM entrypoint. The package metadata is copied from the legitimate neverthrow repository to impersonate an official companion package.

Users who mistakenly install [email protected] may execute arbitrary code on their systems due to the preinstall script running automatically. The payload is fetched from an untrusted, mutable Dropbox URL without integrity checks, allowing an attacker to deliver any code. This can lead to system compromise or further malicious activity. The impersonation of a legitimate package increases the likelihood of accidental installation.

Avoid installing [email protected]. Verify package names carefully to avoid typosquatting attacks. Since no official patch or fix exists for this malicious package, the best mitigation is to remove any installations of [email protected] and rely only on the legitimate neverthrow package. Monitor package sources and use tools that detect typosquatting or malicious npm packages.