MAL-2026-10508 Malicious code in nodemon-elint (npm)

[email protected] copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a confusable name. Its package.json declares a runtime dependency on type-elint@^3.3.7, which is not required or imported by any file under lib/ and has no documented purpose in the package. Installing nodemon-elint therefore causes npm to resolve and install type-elint into the installer's dependency tree, where any install-time lifecycle scripts or require-time side effects in that sibling package execute on the installer's machine. The package.json also lists chai@^4.4.1 — a test assertion library — under dependencies rather than devDependencies, with no require('chai') anywhere in lib/, an additional anomalous production dependency inconsistent with upstream nodemon. The pattern (name-confusion wrapper of a popular package + undocumented, unused sibling dependency whose name mirrors the typosquat scheme) is a dependency-chain drop: the wrapper itself contains no visible payload, but installing it pulls in attacker-controlled code via the forced dependency.