MAL-2026-13706

    Dashboard / Malicious Package / MAL-2026-13706

    MAL-2026-13706

    Published: 10 Aug 2026Last Modified: 10 Aug 2026

    Summary: Malicious code in neverthrow-js (npm)

    Details: Source: amazon-inspector (2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd) Package [email protected] is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path /wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) so the literal C2 URL never appears in source. It fetches a response, base64-decodes the body, and executes it via new Function("rq", parsed); nfu(require)(), passing require into the evaluated code so the remote payload has full Node capability on the installer's host. Execution is gated by a Date check for 2026-08-11 02:00:00 GMT. index.cjs.js reproduces the real neverthrow library to provide cover for the malicious install hook.

    References: https://www.npmjs.com/package/neverthrow-js/v/2.0.0

    Affected packages

    Package

    Name: neverthrow-js

    Purl: pkg:npm/neverthrow-js

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.0.0
    MAL-2026-13706 | CVE-DB