The npm package 'runtimekit' versions 1.0.1 and 1.0.5 contain malicious code that executes arbitrary JavaScript during module load. The package includes an obfuscated self-executing function that decodes hidden strings to dynamically construct and run code with full Node.js privileges. This behavior occurs when requiring 'runtimekit' or 'runtimekit/readonly', allowing the malicious payload to run in-process. The package falsely advertises itself as a validation/runtime utility but embeds a loader with no legitimate purpose for obfuscation. No official patch or remediation guidance is currently provided.