The @railone/image-utils npm package version 1.1.10 includes a malicious payload triggered on import. The main script spawns a detached child process running loader.js, which fetches JSON data from a third-party mutable endpoint (https://api.npoint.io/641d37178a880b1e8b8f). The 'code' field in the JSON is base64-decoded and executed dynamically using the Function constructor, allowing arbitrary attacker-controlled JavaScript to run with full Node.js privileges and network access on the host machine. This mechanism provides a persistent remote code execution channel controlled by whoever manages the npoint.io resource. The package misrepresents its functionality and contains internal comments identifying it as a module for device information collection and remote code execution that auto-starts on import.

Successful exploitation results in arbitrary remote code execution on the host system with full Node.js privileges and network access. This allows an attacker to run any code, potentially leading to full system compromise, data exfiltration, or further lateral movement. The malicious code is persistently delivered via a mutable third-party endpoint, enabling ongoing control over affected systems.

No official patch or remediation is currently documented. Users should immediately remove the @railone/image-utils package version 1.1.10 from their environments and avoid installing it. Since the malicious code executes on import, any usage of this package should be considered compromised. Monitor for the presence of this package in dependency trees and replace it with trusted alternatives. Check vendor advisories or npm security advisories for updates or official guidance.