The 'loadutils' package on npm is a typosquatting malicious package targeting users expecting the legitimate 'loader-utils' helper. Although its README documents loader-utils APIs, the actual code exports a debug-style logger that immediately requires and executes a module named 'debug-glitzs', which is not declared as a dependency. Additionally, it declares an unrelated runtime dependency 'lessload@^1.0.1' that is never used in the source code, further increasing the attack surface. The package metadata impersonates a known maintainer, adding to its deceptive nature. This behavior can lead to execution of untrusted code in the Node.js process when the package is imported.

If installed and imported, this package executes untrusted code immediately, potentially compromising the host environment. The undeclared dependency and unrelated runtime dependencies increase the risk of malicious code execution or supply chain compromise. The impersonation of a known maintainer may mislead developers into trusting and using this malicious package.

No official patch or remediation is currently available. Users should avoid installing or using the 'loadutils' package, especially version 1.0.4. Verify package names carefully to avoid typosquatting attacks and prefer the legitimate 'loader-utils' package. Monitor dependency trees for unexpected or undeclared dependencies. Check vendor advisories or npm security advisories for updates or removal notices regarding this package.