MAL-2026-13706
Malicious code in neverthrow-js (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd) Package neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path /wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) so the literal C2 URL never appears in source. It fetches a response, base64-decodes the body, and executes it via new Function("rq", parsed); nfu(require)(), passing require into the evaluated code so the remote payload has full Node capability on the installer's host. Execution is gated by a Date check for 2026-08-11 02:00:00 GMT. index.cjs.js reproduces the real neverthrow library to provide cover for the malicious install hook.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for neverthrow-js (npm). Pin to a known-safe version or switch to an alternative.