MAL-2026-13706

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neverthrow-js/MAL-2026-13706.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13706
Published
2026-08-10T12:32:39Z
Modified
2026-08-10T13:05:01.606227731Z
Summary
Malicious code in neverthrow-js (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd)

Package neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path /wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) so the literal C2 URL never appears in source. It fetches a response, base64-decodes the body, and executes it via new Function("rq", parsed); nfu(require)(), passing require into the evaluated code so the remote payload has full Node capability on the installer's host. Execution is gated by a Date check for 2026-08-11 02:00:00 GMT. index.cjs.js reproduces the real neverthrow library to provide cover for the malicious install hook.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017272",
            "import_time": "2026-08-10T12:51:45.354323959Z",
            "sha256": "2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd",
            "versions": [
                "2.0.0"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-10T12:32:39Z"
        }
    ]
}
References
Credits

Affected packages

npm / neverthrow-js

Package

Name
neverthrow-js
View open source insights on deps.dev
Purl
pkg:npm/neverthrow-js

Affected ranges

Affected versions

2.*
2.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/install.js",
            "tlsh": "9f51e0945136640787f1fbb4eb130859faeb56632200c298b9dc45802f7b97893b7dde",
            "sha256": "7a6c6da6ab8f39e08445dba37cd5e5435b39468a3e192c38771e9d824ff195fd"
        }
    ],
    "package_integrity": [
        {
            "filename": "neverthrow-js-2.0.0.tgz",
            "hashes": {
                "sha1": "16372f4b75561c88775d5fd8612daa1ecb10fa08",
                "sha512_sri": "sha512-Wn+VcdCQ5XXhNodBXzcDDMODdOeKacobmJ67qbupBP3QHjR/ifX5zDnS7nxj4UxLFyTQ8P61NTs6+P+/3XiUhg=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neverthrow-js/MAL-2026-13706.json"