neverthrow-js@5.0.0

Analysis

`neverthrow-js` is a combosquat of the legitimate `neverthrow` error-handling library: the real package name is kept intact with a `-js` suffix appended, and the tarball ships a copy of the upstream neverthrow source tree (dist/index.cjs.js, dist/index[.]es.js, dist/index.d.ts, README.md, LICENSE) with the repository and author metadata rewritten to point at a look-alike GitHub path. Version 5.0.0 itself contains no lifecycle hooks, no network code, no dynamic code evaluation, no child-process use and no credential or file access — the shipped JavaScript is the unmodified neverthrow library — so this version carries no executable payload of its own; the package name exists to attract installs intended for the impersonated library.