runtime-sentinel @1.0.2

Summary

The package's postinstall script (src/test.js) issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled (rejectUnauthorized: false), and passes the response body directly to new Function('require', data)(require) . This executes attacker-controlled code with full Node.js require access on the installer's machine at npm install time. The remote content is unpinned, unverified, and served from a mutable third-party host; whatever bytes the endpoint returns run on the installer. The package presents itself as a runtime monitoring toolkit and ships generic placeholder author metadata ( Your Name ), which does not match the postinstall behavior.

Source: amazon-inspector (f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1)