Malicious code in neverthrow-js (npm)
The package [email protected] is a malicious typosquat of the legitimate neverthrow library on npm. It contains a postinstall script that executes automatically during installation, which fetches and executes a remote payload with full Node.js capabilities. The malicious code hides its command and control (C2) URL by reconstructing it from decoy arrays mimicking WordPress plugin metadata. Execution of the payload is delayed until a specific date in 2026. The package attempts to appear legitimate by reproducing the real neverthrow library code alongside the malicious install hook.
AI Analysis
Technical Summary
The neverthrow-js package version 2.0.0 is a typosquatting malicious package designed to deceive users into installing it instead of the legitimate neverthrow library. Upon installation, its postinstall script runs automatically, reconstructing a hidden C2 URL from obfuscated fragments resembling WordPress plugin metadata. It fetches a base64-encoded payload from this URL, decodes it, and executes it dynamically with full access to Node.js require, allowing arbitrary code execution on the host system. The payload execution is gated by a date check, only activating after August 11, 2026. The package includes code mimicking the legitimate neverthrow library to avoid suspicion.
Potential Impact
If installed, the malicious postinstall script can execute arbitrary code with full Node.js privileges on the host machine, potentially leading to complete compromise of the system where the package is installed. The delayed execution mechanism may evade early detection. This can result in unauthorized access, data theft, or further malicious activities initiated by the attacker-controlled payload.
Mitigation Recommendations
Users should avoid installing [email protected] as it is a malicious typosquat package. Verify package names carefully before installation, especially for similarly named packages. Since no patch or official fix exists for this malicious package, remediation involves removing the package if installed and scanning the system for any signs of compromise. Use only the legitimate neverthrow package from trusted sources. Monitor npm advisories and security feeds for updates on typosquatting threats.
Malicious code in neverthrow-js (npm)
Description
The package [email protected] is a malicious typosquat of the legitimate neverthrow library on npm. It contains a postinstall script that executes automatically during installation, which fetches and executes a remote payload with full Node.js capabilities. The malicious code hides its command and control (C2) URL by reconstructing it from decoy arrays mimicking WordPress plugin metadata. Execution of the payload is delayed until a specific date in 2026. The package attempts to appear legitimate by reproducing the real neverthrow library code alongside the malicious install hook.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The neverthrow-js package version 2.0.0 is a typosquatting malicious package designed to deceive users into installing it instead of the legitimate neverthrow library. Upon installation, its postinstall script runs automatically, reconstructing a hidden C2 URL from obfuscated fragments resembling WordPress plugin metadata. It fetches a base64-encoded payload from this URL, decodes it, and executes it dynamically with full access to Node.js require, allowing arbitrary code execution on the host system. The payload execution is gated by a date check, only activating after August 11, 2026. The package includes code mimicking the legitimate neverthrow library to avoid suspicion.
Potential Impact
If installed, the malicious postinstall script can execute arbitrary code with full Node.js privileges on the host machine, potentially leading to complete compromise of the system where the package is installed. The delayed execution mechanism may evade early detection. This can result in unauthorized access, data theft, or further malicious activities initiated by the attacker-controlled payload.
Mitigation Recommendations
Users should avoid installing [email protected] as it is a malicious typosquat package. Verify package names carefully before installation, especially for similarly named packages. Since no patch or official fix exists for this malicious package, remediation involves removing the package if installed and scanning the system for any signs of compromise. Use only the legitimate neverthrow package from trusted sources. Monitor npm advisories and security feeds for updates on typosquatting threats.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13706
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a79f0c4bf8831d539f5dcbb
Added to database: 08/10/2026, 15:39:48 UTC
Last enriched: 08/10/2026, 15:43:12 UTC
Last updated: 08/10/2026, 15:43:12 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.