The npm package @thone33/analytics-injector versions 1.0.0 and 1.0.1 contains malicious code that executes attacker-controlled JavaScript. Its activate() function fetches a script from a mutable remote repository without integrity checks and evaluates it with full Node.js process privileges. This allows remote code execution controlled by an attacker. The package masquerades as an analytics helper but is designed for misdirection. No official patch or remediation is currently documented.