The 'loadutils' npm package (version 1.0.4) is a typosquatting attack targeting users expecting the legitimate 'loader-utils' package. Although the README documents loader-utils APIs, the actual code exports a debug-style logger that requires and executes a module named 'debug-glitzs' at the top level, which is not declared as a dependency. This causes arbitrary code to run when 'loadutils' is imported. The package.json also declares a runtime dependency 'lessload@^1.0.1' that is unrelated and unused in the source, pulling additional unaccounted code into the dependency tree. The contributors metadata impersonates a known maintainer, increasing the deception. No CVSS score or known exploits in the wild are reported.

Users installing or importing 'loadutils' version 1.0.4 may unknowingly execute malicious code due to the top-level require of an undeclared and potentially harmful module 'debug-glitzs'. The inclusion of unrelated dependencies further increases the risk of executing untrusted code. This can lead to compromise of the Node.js process environment where the package is used. The impersonation of a known maintainer may increase the likelihood of installation by deceiving users.

No official patch or remediation is currently documented. Users should avoid installing or using the 'loadutils' package, especially version 1.0.4. Verify package names carefully to avoid typosquatting attacks and prefer installing the legitimate 'loader-utils' package. Monitor dependency trees for unexpected or undeclared dependencies. Check vendor advisories or npm security advisories for updates or removal of the malicious package.