neverthrow-js@5.5.1

Analysis

neverthrow-js is a combosquat of the legitimate `neverthrow` library: it republishes the upstream package's code and README verbatim (upstream supermacro GitHub badges, wiki links and sponsor links are still present) while rewriting the documented install and import instructions from `neverthrow` to `neverthrow-js`, so developers following the docs install the lookalike. The package metadata points its repository, homepage and bugs URLs at a github[.]com/neverthrow-js/neverthrow repository that does not correspond to the upstream project, and it declares an optionalDependency on @rollup/rollup-linux-x64-gnu, a build-time-only package the runtime library never uses. Version 5.5.1 contains no lifecycle hooks and no network, process-execution or environment access; the shipped dist/index.cjs.js and dist/index[.]es.js are unmodified upstream rollup output. The package name has previously been used to distribute malicious code.