The npm package @railone/image-utils version 1.1.10 contains malicious code that executes attacker-controlled JavaScript upon import. It spawns a hidden child process that fetches and runs base64-encoded code from a mutable third-party JSON endpoint, enabling persistent remote code execution with full Node.js privileges and network access. The package falsely advertises image utility functions but instead acts as a backdoor for device information collection and remote code execution.