# MAL-2026-14283: Malicious code in neverthrow-core (npm)


- **Type:** Malicious package
- **Package:** `neverthrow-core` (npm)
- **Published:** 19 Aug 2026

## What is MAL-2026-14283?

MAL-2026-14283 is a malicious package in neverthrow-core, published on 19 Aug 2026. 

### Official description

neverthrow-core@1.1.2 is a typosquat of the popular `neverthrow` library. Its package.json declares a `preinstall` script `node -e "require('./dist/index.cjs.js').bcryptInstall()"` that auto-runs on every `npm install`. The invoked `bcryptInstall` function inside the CJS bundle fetches `https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz`, streams the archive to disk via `Readable.from`/`pipeline`, `chmod`s the extracted files, and executes them using `spawnSync` and `createRequire`. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate `neverthrow` publisher. The dropper is only present in the CJS bundle — the sibling ESM build (`dist/index.es.js`) does not contain `bcryptInstall`, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package.

## What should I do about MAL-2026-14283?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14283 is a malicious package: neverthrow-core (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14283/ (Markdown: https://insights.sbomify.com/MAL-2026-14283/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14283

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14283/
Summaries are generated and may contain mistakes; the official description above is the record.