neverthrow-js@2.0.0

Analysis

The postinstall hook (dist/install.js) of neverthrow-js@2.0.0 fetches a remote payload and executes it. It constructs the URL hxxps://ecoferros[.]com/wp-content/plugins/elementor/modules/dev-tools/index[.]php?req=verify from obfuscated string fragments, downloads the response, base64-decodes it, and runs it via new Function with the require function passed in — executing arbitrary remote code at install time. The payload is served remotely rather than shipped in the package, and the hook is time-gated to activate after 2026-08-11 02:00:00 GMT. C2 host: ecoferros[.]com.