The npm package netspeedutil version 1.0.13 contains malicious code that compromises the build pipeline of projects using it. Upon installation, it scans for image files with a special marker, decrypts a hidden payload, and patches the build command of third-party CLIs to inject obfuscated malicious client code. This client establishes a covert WebRTC TURN connection to an attacker-controlled server, enabling remote control and injection of attacker-supplied content into the end users' browsers. The package masquerades as a utility for string matching but is actually a supply-chain malware that weaponizes production artifacts against end users.