If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd)
Package neverthrow-js@2.0.0 is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs automatically on npm install. The install script reconstructs the destination host and path from decoy arrays that mimic WordPress plugin metadata (filtered fragments yielding ecoferros.com and the path /wp-content/plugins/elementor/admin/dev-tools/index.php?req=verify) so the literal C2 URL never appears in source. It fetches a response, base64-decodes the body, and executes it via new Function("rq", parsed); nfu(require)(), passing require into the evaluated code so the remote payload has full Node capability on the installer's host. Execution is gated by a Date check for 2026-08-11 02:00:00 GMT. index.cjs.js reproduces the real neverthrow library to provide cover for the malicious install hook.