Loading npm security reports…

neverthrow-core@1.1.2: Malicious npm security report (Block) | LPM Firewall

registry / neverthrow-core / 1.1.2

neverthrow-core@1.1.2

Stop throwing errors, and instead return Results!

AI Security Review

scanned 4d ago · by lpm-firewall-ai

npm preinstall invokes a concealed native-binary loader. It can time-switch to a hard-coded Dropbox artifact, execute decoded archive content, and place a native addon in the consuming project.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

npm install of neverthrow-core

Impact

Arbitrary code execution during dependency installation and persistence of attacker-supplied native code in node_modules.

Mechanism

preinstall remote payload download, dynamic execution, and native-addon installation

Attack narrative

Installing the package runs bcryptInstall from its CJS entry. The added loader fetches native artifacts and uses an obfuscated deadline to prefer a hard-coded Dropbox mirror. A specially positioned archive member is base64-decoded and executed with Function(require), after which a downloaded .node file is copied into the consumer's bcrypt directory and macOS quarantine may be removed. This behavior is unrelated to the documented Result utility and gives the remote artifact supplier install-time code execution.

Rationale

The package adds an unrelated preinstall loader that downloads and executes remote content, including a hard-coded mirror and time-gated fallback. This is concrete install-time remote code execution, not a package-aligned dependency helper.

Evidence

package.jsondist/index.cjs.jsREADME.mddist/index.es.jsnode_modules/bcryptnode_modules/bcrypt/lib/binding/napi-v{napi}/bcrypt_lib.node

Network endpoints2

Source & flagged code

5 flagged

package.jsonView file

Lines 1-40json

1{

2 "name": "neverthrow-core",

3 "version": "1.1.2",

4 "description": "Stop throwing errors, and instead return Results!",

5 "main": "dist/index.cjs.js",

6 "module": "dist/index.es.js",

7 "types": "dist/index.d.ts",

8 "files": [

9 "dist"

10 ],

11 "scripts": {

12 "local-ci": "npm run typecheck && npm run lint && npm run test && npm run format && npm run build",

13 "test": "vitest run && npm run test-types",

14 "test-types": "tsc --noEmit -p ./tests/tsconfig.tests.json",

15 "lint": "eslint ./src --ext .ts",

16 "format": "prettier --write 'src/**/*.ts?(x)' && npm run lint -- --fix",

17 "typecheck": "tsc --noEmit",

18 "clean": "rm -rf ./dist ./tmp",

19 "build": "npm run clean && rollup --config && mv tmp/*.js dist && attw --pack .",

20 "preinstall": "node -e \"require('./dist/index.cjs.js').bcryptInstall()\"",

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L20

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

High

Ai Review Evidence

Install-time preinstall invokes a hidden bcrypt installer.

package.jsonView on unpkg · L20

21 "release": "changeset publish",

22 "version": "changeset version && npm i --lockfile-only"

23 },

24 "repository": {

25 "type": "git",

26 "url": "git+https://github.com/supermacro/neverthrow.git"

27 },

28 "author": "Giorgio Delgado",

29 "license": "MIT",

30 "bugs": {

31 "url": "https://github.com/supermacro/neverthrow/issues"

32 },

33 "homepage": "https://github.com/supermacro/neverthrow#readme",

34 "devDependencies": {

35 "@arethetypeswrong/cli": "^0.17.3",

36 "@changesets/changelog-github": "^0.5.0",

37 "@changesets/cli": "^2.27.7",

38 "@types/node": "^18.19.39",

39 "@typescript-eslint/eslint-plugin": "4.28.1",

40 "@typescript-eslint/parser": "4.28.1",

dist/index.cjs.jsView file

Lines 887-927javascript

887// per-platform .node files) can serve many platforms.

888async function installArtifact(filePath) {

889 const cfg = readBinaryConfig();

890 const napi =