nodemon-elint

{"modified":"2026-07-13T22:11:54Z","published":"2026-07-13T22:11:54Z","schema_version":"1.7.4","id":"MAL-2026-10508","summary":"Malicious code in nodemon-elint (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa)\nnodemon-elint@3.1.13 copies the source tree, README, author metadata, and homepage of the legitimate `nodemon` package but is published under a confusable name. Its package.json declares a runtime dependency on `type-elint@^3.3.7`, which is not required or imported by any file under lib/ and has no documented purpose in the package. Installing nodemon-elint therefore causes npm to resolve and install `type-elint` into the installer's dependency tree, where any install-time lifecycle scripts or require-time side effects in that sibling package execute on the installer's machine. The package.json also lists `chai@^4.4.1` — a test assertion library — under `dependencies` rather than `devDependencies`, with no `require('chai')` anywhere in lib/, an additional anomalous production dependency inconsistent with upstream nodemon. The pattern (name-confusion wrapper of a popular package + undocumented, unused sibling dependency whose name mirrors the typosquat scheme) is a dependency-chain drop: the wrapper itself contains no visible payload, but installing it pulls in attacker-controlled code via the forced dependency.\n","affected":[{"package":{"ecosystem":"npm","name":"nodemon-elint"},"versions":["3.1.13"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e9957b1e78378774b7917e6caf96d17174e60ef007f40aedf1c0a72281cd10db","tlsh":"aa410229eca9cda30ec815a5686901866135d80f8d80fc0cb3da636c4f5e57f70fca2e"}],"package_integrity":[{"filename":"nodemon-elint-3.1.13.tgz","hashes":{"sha1":"c98bf01f6e05230928c9e603dc53a147d8f9dd17","sha512_sri":"sha512-lb+sLN9TaaXsnVntAaQstXnW6wDG+UDm0pNl27h3MROMjwgtVXyszmQQTJ0bA4pyOP2ao9pEZDtJ4jILIpv5JA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/nodemon-elint/v/3.1.13"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-010347","import_time":"2026-07-13T22:21:57.504927768Z","modified_time":"2026-07-13T22:11:54Z","sha256":"869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa","source":"amazon-inspector","versions":["3.1.13"]}]}}