Malicious code in neverthrow-core (npm)

neverthrow-core@1.1.2 on npm is a typosquatting attack targeting the popular neverthrow library. The malicious package includes a preinstall script in package.json that automatically executes during installation, invoking a bcryptInstall() function from the CommonJS bundle.

The bcryptInstall function fetches a tar.gz archive from an anonymous, mutable Dropbox URL (https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz), streams it to disk, extracts it, changes file permissions, and executes the contents using spawnSync and createRequire. No signature verification or hash pinning is performed on the downloaded payload.

The malicious code is deliberately hidden in the CommonJS build only; the ESM entrypoint (dist/index.es.js) does not contain the bcryptInstall function, potentially evading detection by users who inspect the ESM source. Package metadata (repository, homepage, author) is copied from the legitimate supermacro/neverthrow project to impersonate an official companion package.

The attack was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.