MAL-2026-12432

    Dashboard / Malicious Package / MAL-2026-12432

    MAL-2026-12432

    Published: 5 Aug 2026Last Modified: 5 Aug 2026

    Summary: Malicious code in runtime-sentinel (npm)

    Details: Source: amazon-inspector (f44234b49595ac2b15e3b5249920f7ff64cf897b7543da959e95621814948da1) The package's postinstall script (src/test.js) issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate verification disabled (rejectUnauthorized: false), and passes the response body directly to `new Function('require', data)(require)`. This executes attacker-controlled code with full Node.js `require` access on the installer's machine at `npm install` time. The remote content is unpinned, unverified, and served from a mutable third-party host; whatever bytes the endpoint returns run on the installer. The package presents itself as a runtime monitoring toolkit and ships generic placeholder author metadata (`Your Name`), which does not match the postinstall behavior.

    References: https://www.npmjs.com/package/runtime-sentinel/v/1.0.1, https://www.npmjs.com/package/runtime-sentinel/v/1.0.2

    Affected packages

    Package

    Name: runtime-sentinel

    Purl: pkg:npm/runtime-sentinel

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.1
    1.0.2
    MAL-2026-12432 | CVE-DB