The 'runtimekit' npm package versions 1.0.1 and 1.0.5 include a self-executing Immediately Invoked Function Expression (IIFE) that decodes obfuscated strings to retrieve the Function constructor and dynamically execute arbitrary JavaScript code at module load time. The loader exposes Node.js require and module objects globally to enable the dynamically constructed function to access them outside the module closure. This results in execution of a hidden payload with full Node privileges whenever the package or its 'readonly' submodule is required. The obfuscation and global exposure of Node internals indicate malicious intent, as there is no legitimate reason for such behavior in a runtime utility package. No patch or fix information is provided in the source data.

Any application or environment that installs and requires 'runtimekit' versions 1.0.1 or 1.0.5 will execute arbitrary, obfuscated JavaScript code with full Node.js privileges. This can lead to compromise of the host environment, unauthorized code execution, data theft, or further malicious activity. The malicious code runs in-process, making detection and containment more difficult. There is no indication of known exploits in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix or official guidance is available, avoid installing or requiring the 'runtimekit' package versions 1.0.1 and 1.0.5. Remove these versions from any environments where they are present. Consider using alternative, trusted packages for runtime or validation utilities. Monitor package sources and supply chain for updates or advisories regarding this package.