MAL-2026-10508

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nodemon-elint/MAL-2026-10508.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10508
Published
2026-07-13T22:11:54Z
Modified
2026-07-13T22:31:56Z
Summary
Malicious code in nodemon-elint (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa)

nodemon-elint@3.1.13 copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a confusable name. Its package.json declares a runtime dependency on type-elint@^3.3.7, which is not required or imported by any file under lib/ and has no documented purpose in the package. Installing nodemon-elint therefore causes npm to resolve and install type-elint into the installer's dependency tree, where any install-time lifecycle scripts or require-time side effects in that sibling package execute on the installer's machine. The package.json also lists chai@^4.4.1 — a test assertion library — under dependencies rather than devDependencies, with no require('chai') anywhere in lib/, an additional anomalous production dependency inconsistent with upstream nodemon. The pattern (name-confusion wrapper of a popular package + undocumented, unused sibling dependency whose name mirrors the typosquat scheme) is a dependency-chain drop: the wrapper itself contains no visible payload, but installing it pulls in attacker-controlled code via the forced dependency.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-010347",
            "import_time": "2026-07-13T22:21:57.504927768Z",
            "modified_time": "2026-07-13T22:11:54Z",
            "sha256": "869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa",
            "source": "amazon-inspector",
            "versions": [
                "3.1.13"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / nodemon-elint

Package

Name
nodemon-elint
View open source insights on deps.dev
Purl
pkg:npm/nodemon-elint

Affected ranges

Affected versions

3.*
3.1.13

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "e9957b1e78378774b7917e6caf96d17174e60ef007f40aedf1c0a72281cd10db",
            "tlsh": "aa410229eca9cda30ec815a5686901866135d80f8d80fc0cb3da636c4f5e57f70fca2e"
        }
    ],
    "package_integrity": [
        {
            "filename": "nodemon-elint-3.1.13.tgz",
            "hashes": {
                "sha1": "c98bf01f6e05230928c9e603dc53a147d8f9dd17",
                "sha512_sri": "sha512-lb+sLN9TaaXsnVntAaQstXnW6wDG+UDm0pNl27h3MROMjwgtVXyszmQQTJ0bA4pyOP2ao9pEZDtJ4jILIpv5JA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/nodemon-elint/MAL-2026-10508.json"