registry / neverthrow-js / 2.0.0

neverthrow-js@2.0.0

OSV Malicious Advisory

scanned 5d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-13706 confirms this npm version as malicious. Package neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path...

Advisory

MAL-2026-13706

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in neverthrow-js (npm)

Details

Package neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path /wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) so the literal C2 URL never appears in source. It fetches a response, base64-decodes the body, and executes it via new Function("rq", parsed); nfu(require)(), passing require into the evaluated code so the remote payload has full Node capability on the installer's host. Execution is gated by a Date check for 2026-08-11 02:00:00 GMT. index.cjs.js reproduces the real neverthrow library to provide cover for the malicious install hook.

Decision reason

One or more suspicious static signals were detected.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

Behavioral surface

Source

EvalNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 39.0 KB of source

Source & flagged code

3 flagged

package.jsonView file

•scripts.postinstall = node ./dist/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.jsView file

93).toString("utf8"); L94: const nfu = new Function("rq", parsed); L95: nfu(require)();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/install.jsView on unpkg · L93

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/install.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/install.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/install.jsView file

93).toString("utf8"); L94: const nfu = new Function("rq", parsed); L95: nfu(require)();

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/install.jsView on unpkg · L93

Findings

1 High2 Medium2 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

LowScripts Present

LowEvaldist/install.js