neverthrow-core@1.1.2

Analysis

neverthrow-core is a combosquat clone of the neverthrow Result library that injects a preinstall hook (node -e "require('./dist/index.cjs.js').bcryptInstall()"). The hook downloads a tarball from a Dropbox shared link (dropbox[.]com/scl/fi/l5tqqo3mxuemus9cqpbqe/bcrypt-all-platforms.tar.gz, with rlkey/st/dl query parameters) and executes a base64-decoded payload as JavaScript via the Function constructor (new Function("rqr", binary); binary(require)()). The payload is served remotely rather than shipped in the tarball, making this a remote-code-execution dropper. An obfuscated XOR-encoded deadline token is used to force the Dropbox mirror after a hidden date. The genuine neverthrow package has no bcrypt dependency and no preinstall hook.