MAL-2026-14283 Malicious code in neverthrow-core (npm)

[email protected] is a typosquat of the popular neverthrow library. Its package.json declares a preinstall script node -e "require('./dist/index.cjs.js').bcryptInstall()" that auto-runs on every npm install. The invoked bcryptInstall function inside the CJS bundle fetches https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz, streams the archive to disk via Readable.from/pipeline, chmods the extracted files, and executes them using spawnSync and createRequire. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate neverthrow publisher. The dropper is only present in the CJS bundle — the sibling ESM build (dist/index.es.js) does not contain bcryptInstall, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.