OpenSSF/OSV advisory MAL-2026-12432 confirms this npm version as malicious. The package's postinstall script (src/test.js) issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled (rejectUnauthorized: false), and passes the response body directly to `new Function('require', data)(require)`. This executes attacker-controlled code with full Node.js `require` access on the installer's machine at `npm install` time...
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in runtime-sentinel (npm)
Details
The package's postinstall script (src/test.js) issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled (rejectUnauthorized: false), and passes the response body directly to `new Function('require', data)(require)`. This executes attacker-controlled code with full Node.js `require` access on the installer's machine at `npm install` time. The remote content is unpinned, unverified, and served from a mutable third-party host; whatever bytes the endpoint returns run on the installer. The package presents itself as a runtime monitoring toolkit and ships generic placeholder author metadata (`Your Name`), which does not match the postinstall behavior.
Decision reason
OpenSSF Malicious Packages via OSV confirms runtime-sentinel@1.0.1 as malicious (MAL-2026-12432): Malicious code in runtime-sentinel (npm)