The 'runtime-sentinel' npm package (versions 1.0.1 and 1.0.2) includes a postinstall script (src/test.js) that performs an HTTPS GET request to https://workconfig.vercel.app with TLS certificate verification disabled (rejectUnauthorized: false). The response body from this request is passed directly to a new Function constructor that executes the code with full Node.js require access on the installer's machine at install time. The remote code source is unpinned, unverified, and hosted on a mutable third-party server, allowing an attacker to control the code executed during installation. The package falsely presents itself as a runtime monitoring toolkit and uses generic placeholder author metadata, which does not align with its malicious behavior.

This vulnerability allows arbitrary code execution on the machine performing 'npm install' of the affected package versions. Because the remote code is attacker-controlled and executed with full Node.js require privileges, an attacker can execute any code, potentially leading to system compromise, data theft, or further malware installation. The lack of TLS verification and unpinned remote content increases the risk of supply chain attacks.

No official patch or fix is currently documented. Users should avoid installing 'runtime-sentinel' versions 1.0.1 and 1.0.2. It is recommended to remove these versions from projects and replace them with trusted alternatives. Monitor vendor advisories for updates or official remediation. Since this is a malicious package, reporting it to npm and blocking it in dependency management systems is advised.