MAL-2026-10508
Dashboard / Malicious Package / MAL-2026-10508
MAL-2026-10508
Summary: Malicious code in nodemon-elint (npm)
Details: Source: amazon-inspector (869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa) [email protected] copies the source tree, README, author metadata, and homepage of the legitimate `nodemon` package but is published under a confusable name. Its package.json declares a runtime dependency on `type-elint@^3.3.7`, which is not required or imported by any file under lib/ and has no documented purpose in the package. Installing nodemon-elint therefore causes npm to resolve and install `type-elint` into the installer's dependency tree, where any install-time lifecycle scripts or require-time side effects in that sibling package execute on the installer's machine. The package.json also lists `chai@^4.4.1` — a test assertion library — under `dependencies` rather than `devDependencies`, with no `require('chai')` anywhere in lib/, an additional anomalous production dependency inconsistent with upstream nodemon. The pattern (name-confusion wrapper of a popular package + undocumented, unused sibling dependency whose name mirrors the typosquat scheme) is a dependency-chain drop: the wrapper itself contains no visible payload, but installing it pulls in attacker-controlled code via the forced dependency.
Affected packages
Package
Name: nodemon-elint
Purl: pkg:npm/nodemon-elint
Affected ranges
Type: N/A
Events:
