The npm package 'loadutils' is a malicious typosquat of the legitimate 'loader-utils' package. It misrepresents its functionality by documenting the loader-utils API but instead exports unrelated logging code that executes a suspicious module upon import. The package also includes undeclared and unrelated dependencies, and impersonates a known maintainer to deceive users. Version 1.0.4 is affected. No known exploits are reported in the wild.