MAL-2026-14283

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neverthrow-core/MAL-2026-14283.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14283
Published
2026-08-19T07:58:06Z
Modified
2026-08-19T08:34:49Z
Summary
Malicious code in neverthrow-core (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7)

neverthrow-core@1.1.2 is a typosquat of the popular neverthrow library. Its package.json declares a preinstall script node -e "require('./dist/index.cjs.js').bcryptInstall()" that auto-runs on every npm install. The invoked bcryptInstall function inside the CJS bundle fetches https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz, streams the archive to disk via Readable.from/pipeline, chmods the extracted files, and executes them using spawnSync and createRequire. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate neverthrow publisher. The dropper is only present in the CJS bundle — the sibling ESM build (dist/index.es.js) does not contain bcryptInstall, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-018398",
            "import_time": "2026-08-19T08:15:32.061139868Z",
            "modified_time": "2026-08-19T07:58:06Z",
            "sha256": "da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7",
            "source": "amazon-inspector",
            "versions": [
                "1.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / neverthrow-core

Package

Name
neverthrow-core
View open source insights on deps.dev
Purl
pkg:npm/neverthrow-core

Affected ranges

Affected versions

1.*
1.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "2efa0efdf1cd21de6a29234603df5dfec35ae88525a426af421f7a07912d676b",
            "tlsh": "8641cd13cd468c630bf409d6e8b95682f135878f4251cc4b76f6167c4f7669f006aba9"
        },
        {
            "path": "dist/index.cjs.js",
            "sha256": "32a71799223a0807c36e0278fae3ed7c2fcfd3178eb2cc72e1a4f30c541b8de2",
            "tlsh": "4313d79d2ad6b6324b7277b6e7178015ff364423261482a4fa9c92d03f36858c275efc"
        }
    ],
    "package_integrity": [
        {
            "filename": "neverthrow-core-1.1.2.tgz",
            "hashes": {
                "sha1": "ee1c204f9a2d5cc6090d14bd4dbb6065c0f1929a",
                "sha512_sri": "sha512-IlF2AIgysHZ8Xe3BiJ2Ssa5uN3/42ezpEo7PwhJjRL5E9uZH27yf3UDk3TAq80ptD9dKLvSQtqPGDM0DuiTJVQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/neverthrow-core/MAL-2026-14283.json"