MalwarePublished 29 Jun 2026Updated 27 Jul 2026

@thone33/core-utils (npm) · Malicious Code

Affects @thone33/core-utilsSource GCVE Database

Malicious package : remove @thone33/core-utils and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6564

What to do

Remove @thone33/core-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@thone33/core-utils	Affected 1.0.0 – 1.0.5 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @thone33/core-utils versions 1.0.0 through 1.0.5 contains malicious code that activates a hidden payload in production environments. The package imports and invokes code from a related dependency @thone33/analytics-injector only when NODE_ENV is set to 'production', enabling stealthy execution of arbitrary code in production while remaining dormant in development and CI environments. This behavior allows the author to inject malicious code into consumers' production runtimes via minor or patch updates to the pinned dependency without changes to the core-utils package itself.

Impact

Consumers of @thone33/core-utils versions 1.0.0 through 1.0.5 who run their applications with NODE_ENV=production are at risk of executing arbitrary and potentially malicious code injected via the @thone33/analytics-injector dependency. This can lead to unauthorized actions or compromise of the production environment. The malicious code remains dormant in non-production environments, increasing the likelihood of unnoticed compromise until deployment.

Defensive guidance

Users should immediately audit and remove the @thone33/core-utils package and its dependencies from their projects. Avoid using this package in production environments. Monitor for any updates from the package maintainers or npm advisories for potential fixes or removals. Consider replacing this package with trusted alternatives.

Summary

@thone33/core-utils versions 1.0.0 to 1.0.5 act as a loader stub that conditionally executes code from the @thone33/analytics-injector package when the environment variable NODE_ENV equals 'production'. This design conceals malicious payload activation in production only, evading detection in development or CI. Because the dependency is pinned with a caret (^1.0.0), the author can deliver arbitrary code changes through minor or patch releases of the analytics-injector package, effectively enabling dynamic malicious code injection into production environments of consumers relying on core-utils.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Jun 2026, 22:41 UTC

Technical details

References

Community reviews