neverthrow-core @1.1.2

Summary

neverthrow-core@1.1.2 is a typosquat of the popular neverthrow library. Its package.json declares a preinstall script node -e "require('./dist/index.cjs.js').bcryptInstall()" that auto-runs on every npm install . The invoked bcryptInstall function inside the CJS bundle fetches https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz , streams the archive to disk via Readable.from / pipeline , chmod s the extracted files, and executes them using spawnSync and createRequire . The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate neverthrow publisher. The dropper is only present in the CJS bundle — the sibling ESM build ( dist/index.es.js ) does not contain bcryptInstall , hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.

Source: amazon-inspector (da6f9496a578c672b465944e85c471edd19ce837ec7693d472d6c4a3ea3733a7)