The npm package 'runtime-sentinel' versions 1.0.1 and 1.0.2 contains malicious code in its postinstall script. This script disables TLS certificate verification and fetches remote code from an untrusted source, then executes it with full Node.js require privileges during installation. The package masquerades as a runtime monitoring toolkit but executes attacker-controlled code, posing a significant security risk.