Runtime code is the part of a program that executes when the software is actually used, not just when it is installed. In a library or package, this means the logic that runs when another application imports it, calls its functions, or processes its data. Because it lives in ordinary execution paths, it can look harmless during installation and still do damage later.
This matters in cyber security because many defenders focus on install-time checks such as npm lifecycle scripts, but malicious behavior can be hidden in normal application flow. In a supply-chain attack, a package may appear legitimate while embedding harmful logic inside exported methods or other runtime functions. That makes review harder: metadata and install hooks may be clean, yet the code can still steal data, change behavior, or load further payloads when used. Defenders should inspect what dependencies do at execution time, not only what they do during installation.