npm · Malicious package advisory
Malware@railone/image-utils
GHSA-h72c-8fwp-p292
Malicious code in @railone/image-utils (npm)
Details
**Severity:** Critical
**Affected versions:** `= 1.1.10`
## Source: amazon-inspector (ebec05d8415347cef93849315a26f4221e34efa278fffe1b89700af039246dc6)
On import, index.js calls initialize() which spawns a detached, stdio-suppressed, windowsHide `node loader.js` child (init.js) and records its PID. loader.js HTTPS-fetches JSON from https://api.npoint.io/641d37178a880b1e8b8f, base64-decodes the `code` field, and executes it via `new Function('require','__dirname','__filename','module','exports', decodedCode)(...)`, running arbitrary attacker-controlled JavaScript on the installer's host with full Node privileges and network access. The npoint.io endpoint is a mutable third-party JSON store whose contents can be changed at any time by whoever controls that resource, giving that party a persistent remote code-push channel into every installer. The package advertises itself as an image/runtime utility exposing `getProcessInfo`/`getRuntimeInfo`, but no such functions are exported; internal comments identify the code as an 'ID-10 Client Module' for 'device information collection and remote code execution' with 'AUTO-START ON IMPORT'.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b4f738c2719bc533615f8c2b6a5ab143ced7546b/osv/malicious/npm/@railone/image-utils/MAL-2026-16261.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/b4f738c2719bc533615f8c2b6a5ab143ced7546b/osv/malicious/npm/@railone/image-utils/MAL-2026-16261.json
- https://www.npmjs.com/package/@railone/image-utils/v/1.1.10
- https://github.com/advisories/GHSA-h72c-8fwp-p292Compromised versions (1)
- = 1.1.10
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.