@thone33/core-utils versions 1.0.0 to 1.0.5 act as a loader stub that conditionally executes code from the @thone33/analytics-injector package when the environment variable NODE_ENV equals 'production'. This design conceals malicious payload activation in production only, evading detection in development or CI. Because the dependency is pinned with a caret (^1.0.0), the author can deliver arbitrary code changes through minor or patch releases of the analytics-injector package, effectively enabling dynamic malicious code injection into production environments of consumers relying on core-utils.

Consumers of @thone33/core-utils versions 1.0.0 through 1.0.5 who run their applications with NODE_ENV=production are at risk of executing arbitrary and potentially malicious code injected via the @thone33/analytics-injector dependency. This can lead to unauthorized actions or compromise of the production environment. The malicious code remains dormant in non-production environments, increasing the likelihood of unnoticed compromise until deployment.

No official patch or remediation is currently documented. Users should immediately audit and remove the @thone33/core-utils package and its dependencies from their projects. Avoid using this package in production environments. Monitor for any updates from the package maintainers or npm advisories for potential fixes or removals. Consider replacing this package with trusted alternatives. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.