MAL-2026-10014

The npm package nodemon-sudo is a typosquat of the popular nodemon package: its package.json description ("Simple monitor script for use during development of a Node.js app."), main entry (./lib/nodemon), and forged author field (Remy Sharp, the real maintainer of nodemon) are copied from the legitimate project to appear trustworthy. It was published by npm user conodeeth (coxhazelqja151@outlook.com) as a single release, version 3.1.16, with no prior or subsequent versions.

Its package.json declares tslint-conf@^7.2.1 as a direct runtime dependency — a separately-tracked malicious package (see MAL-2026-7022) that itself masquerades as the pino logger and, when its default-exported middleware factory is invoked, spawns a detached background worker (lib/caller.js) that fetches attacker-controlled code from a Pinata IPFS gateway and executes it via new Function.constructor('require', s), granting full filesystem and environment access.

Static review of nodemon-sudo's own source (all 27 JavaScript files in the published tarball, lib/, bin/, and root) found no require('tslint-conf') or other reference to it anywhere in the package's own code — nodemon-sudo itself does not declare an install hook and does not directly invoke the malicious dependency's trigger. Its role in the attack is to typosquat a high-download-count package name and force the known-malicious tslint-conf onto the dependency tree of anyone who installs it (a dependency-confusion / malicious-dependency-bundling distribution vector), positioning it for exploitation by any other code path in the victim's project that later requires and calls it.

Per SafeDep's analysis, nodemon-sudo is linked to the tslint-conf supply-chain campaign (also distributed via the related, separately-tracked packages nodemon-node — MAL-2026-6957 — and ts-await — MAL-2026-6958), attributed with suspected North Korea-linked tradecraft (lookalike package names, jsonkeeper.com...