The npm package @thone33/core-utils versions 1.0.0 through 1.0.5 contains malicious code that activates a hidden payload in production environments. The package imports and invokes code from a related dependency @thone33/analytics-injector only when NODE_ENV is set to 'production', enabling stealthy execution of arbitrary code in production while remaining dormant in development and CI environments. This behavior allows the author to inject malicious code into consumers' production runtimes via minor or patch updates to the pinned dependency without changes to the core-utils package itself.