MalwarePublished 25 Jun 2026Updated 11 Aug 2026

runtimekit (npm) · Malicious Code

Affects runtimekitSource GCVE Database

Malicious package : remove runtimekit and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:55 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-6477

What to do

Remove runtimekit from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmruntimekit	Affected 1.0.1 – 1.1.0 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'runtimekit' versions 1.0.1 and 1.0.5 contain malicious code that executes arbitrary JavaScript during module load. The package includes an obfuscated self-executing function that decodes hidden strings to dynamically construct and run code with full Node.js privileges. This behavior occurs when requiring 'runtimekit' or 'runtimekit/readonly', allowing the malicious payload to run in-process. The package falsely advertises itself as a validation/runtime utility but embeds a loader with no legitimate purpose for obfuscation. No official patch or remediation guidance is currently provided.

Impact

Any application or environment that installs and requires 'runtimekit' versions 1.0.1 or 1.0.5 will execute arbitrary, obfuscated JavaScript code with full Node.js privileges. This can lead to compromise of the host environment, unauthorized code execution, data theft, or further malicious activity. The malicious code runs in-process, making detection and containment more difficult. There is no indication of known exploits in the wild yet.

Defensive guidance

Until a fix or official guidance is available, avoid installing or requiring the 'runtimekit' package versions 1.0.1 and 1.0.5. Remove these versions from any environments where they are present. Consider using alternative, trusted packages for runtime or validation utilities. Monitor package sources and supply chain for updates or advisories regarding this package.

Summary

The 'runtimekit' npm package versions 1.0.1 and 1.0.5 include a self-executing Immediately Invoked Function Expression (IIFE) that decodes obfuscated strings to retrieve the Function constructor and dynamically execute arbitrary JavaScript code at module load time. The loader exposes Node.js require and module objects globally to enable the dynamically constructed function to access them outside the module closure. This results in execution of a hidden payload with full Node privileges whenever the package or its 'readonly' submodule is required. The obfuscation and global exposure of Node internals indicate malicious intent, as there is no legitimate reason for such behavior in a runtime utility package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Jun 2026, 22:44 UTC

Technical details

References

Community reviews