runtime-sentinel@1.0.2
Malicious code in runtime-sentinel (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool TransferT1071.001 · Web Protocols
Analysis
The package runtime-sentinel@1.0.2 contains a postinstall hook (node src/test.js) that fetches code from hxxps://workconfig[.]vercel[.]app over HTTPS and executes it via new Function('require', data.toString())(require). This is a remote-code-execution dropper: the payload is served from the remote host at install time, not shipped in the tarball. The package has no repository verification and its name impersonates a legitimate runtime monitoring tool.
- analyzed by
- Leitwacht
- first seen
- Jul 30, 2026, 04:23 PM
- analyzed
- Jul 30, 2026, 04:23 PM
Related advisories
- streak-math-metrics@1.0.0
- akamai-sensorv3@1.0.0
- streak-metrics-core@1.0.0
- supersig@1.0.5
- @ai-vertical/ai-agent@1.0.0
- akamai-sensorv2@1.0.0
- akamai-sensorv1@1.0.0
- native-hello-plugin@1.2.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.