Runtime execution is code that runs when an application is already loading, importing, or using a dependency, rather than during installation. In JavaScript ecosystems, this often happens when a module is required or an exported function is called. The code may look harmless at install time but remain dormant until a specific code path is reached.
This matters in cyber security because defenses that focus only on install-time checks can miss malicious behavior hidden in runtime logic. Attackers can use runtime execution to delay payloads, avoid package-scanner scrutiny, and trigger actions only inside a live process. Defenders should review package entry points, imported modules, and transitive dependencies, and monitor for unexpected network access, file changes, or process behavior after a dependency is loaded.