Malicious code in neverthrow-js (npm)
neverthrow-js@2.0.0 on npm is a typosquat of the legitimate neverthrow library containing a malicious postinstall script that fetches and executes remote code from ecoferros.com. The payload execution is gated by a date check for 2026-08-11 02:00:00 GMT.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed neverthrow-js@2.0.0 via npm before the package was removed.
- Ecosystems
- Attack vectors
- Affected entities
- neverthrow-js · 2.0.0
neverthrow-js@2.0.0 is a typosquatting attack targeting developers who may confuse it with the legitimate neverthrow library. The malicious package includes a postinstall hook that automatically executes during npm installation.
The install script uses obfuscation techniques, reconstructing a command-and-control URL (ecoferros.com/wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) from decoy arrays mimicking WordPress plugin metadata to avoid detection. Upon execution, it fetches a response, base64-decodes it, and executes the payload via JavaScript's Function constructor with access to Node.js require(), granting the remote attacker full capability on the installer's host.
Execution is conditionally gated by a date check for 2026-08-11 02:00:00 GMT. The package includes a copy of the legitimate neverthrow library code in index.cjs.js to provide cover for the malicious install hook and evade casual inspection.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- neverthrow-js@2.0.0
- Domains
- ecoferros.com
Remediation
- Immediately uninstall neverthrow-js@2.0.0 from all systems and projects
- Use the legitimate neverthrow library instead
- Audit npm install logs and process execution logs on any system that installed neverthrow-js@2.0.0 for signs of remote code execution
- Review and rotate any credentials or secrets that may have been exposed on affected systems
- Monitor affected systems for unexpected outbound connections or suspicious process activity
Sources
- GitHub Advisory GHSA-qpxw-hpjq-29wj · GitHub Advisory Database
Cite this entry
"Malicious code in neverthrow-js (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 10, 2026. https://supplychainattack.org/incident/malicious-code-in-neverthrow-js-npm-1j9djh
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - containedcritical
Malicious code in axios-fast (npm)
axios-fast@1.0.1 on npm contains malicious code that exfiltrates environment variables (including AWS credentials, NPM tokens, and GitHub tokens) to an attacker-controlled webhook during package installation. The package typosquats the legitimate axios HTTP client library.
npmCompromised packageTyposquatting