MAL-2026-14283

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7) neverthrow-core@1.1.2 is a typosquat of the popular `neverthrow` library. Its package.json declares a `preinstall` script `node -e "require('./dist/index.cjs.js').bcryptInstall()"` that auto-runs on every `npm install`. The invoked `bcryptInstall` function inside the CJS bundle fetches `https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz`, streams the archive to disk via `Readable.from`/`pipeline`, `chmod`s the extracted files, and executes them using `spawnSync` and `createRequire`. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate `neverthrow` publisher. The dropper is only present in the CJS bundle — the sibling ESM build (`dist/index.es.js`) does not contain `bcryptInstall`, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.