GCVE-110-OSM-2026-10685

neverthrow-core@1.1.2 is a typosquat of the popular `neverthrow` library. Its package.json declares a `preinstall` script `node -e "require('./dist/index.cjs.js').bcryptInstall()"` that auto-runs on every `npm install`. The invoked `bcryptInstall` function inside the CJS bundle fetches `https://www.dropbox.com/scl/fi/${sha}/bcrypt-all-platforms.tar.gz`, streams the archive to disk via `Readable.from`/`pipeline`, `chmod`s the extracted files, and executes them using `spawnSync` and `createRequire`. The Dropbox path is anonymous and mutable, is not pinned to a package version, and no signature or hash verification is performed; Dropbox is unrelated to the legitimate `neverthrow` publisher. The dropper is only present in the CJS bundle — the sibling ESM build (`dist/index.es.js`) does not contain `bcryptInstall`, hiding the payload from consumers who inspect the ESM entrypoint. Package metadata (repository, homepage, author) is copied from supermacro/neverthrow to impersonate a first-party companion package. Judge assessment: This looks like a typosquatted npm supply-chain dropper impersonating the legitimate `neverthrow` library to deliver a remote payload to unsuspecting installers. The attacker model is clear: the `preinstall` hook in `package.json` auto-runs `node -e "require('./dist/index.cjs.js').bcryptInstall()"`, and the entrypoint `dist/index.cjs.js` reconstructs a Dropbox URL, downloads `bcrypt-all-platforms.tar.gz`, and executes the extracted content via `new Function`, `spawnSync`, and `createRequire`. The code also references `process.env.BCRYPT_FORCE_DIRECT_FETCH` and collects system info, which are classic staging/exfil indicators rather than normal library behavior. The copied `homepage`, `repository`, and author metadata from `supermacro/neverthrow` reinforce the impersonation attempt rather than a benign companion package. ENTRY dist/index.cjs.js (main: dist/index.cjs.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - 2 exfil (reconstructed, custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in dist/index.cjs.js: "process.env.BCRYPT_FORCE_DIRECT_FETCH" - Fetch and Eval/Exec in dist/index.cjs.js: "await extractTarball(filePath, tmp); const nodes = listNodeFiles(tmp); const bin..." - System Information Collection in dist/index.cjs.js: "process.platform" OBFUSCATION - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Reconstructed Obfuscated URL in dist/index.cjs.js: "https://dropbox.com/scl/fi/l5tqqo3mxuemus9cqpbqe/bcrypt-all-platforms.tar.gz" - Dynamic Code Execution in dist/index.cjs.js: "new Function("rqr", binary)" - Shell Command Execution in dist/index.cjs.js: "spawnSync(" - Silent Process Execution in dist/index.cjs.js: "stdio: 'ignore'" - Shell Command Variable Setup in dist/index.cjs.js: "Windows, `npm` is a .cmd shim that needs a sh" PAYLOAD FILES dist/index.cjs.js