nodemon-elint @3.1.13

Summary

nodemon-elint@3.1.13 copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a confusable name. Its package.json declares a runtime dependency on type-elint@^3.3.7 , which is not required or imported by any file under lib/ and has no documented purpose in the package. Installing nodemon-elint therefore causes npm to resolve and install type-elint into the installer's dependency tree, where any install-time lifecycle scripts or require-time side effects in that sibling package execute on the installer's machine. The package.json also lists chai@^4.4.1 — a test assertion library — under dependencies rather than devDependencies , with no require('chai') anywhere in lib/, an additional anomalous production dependency inconsistent with upstream nodemon. The pattern (name-confusion wrapper of a popular package + undocumented, unused sibling dependency whose name mirrors the typosquat scheme) is a dependency-chain drop: the wrapper itself contains no visible payload, but installing it pulls in attacker-controlled code via the forced dependency.

Source: amazon-inspector (869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa)