Malicious code in nodemon-sudo (npm)
The npm package nodemon-sudo is a typosquat of the popular nodemon package: its package.json description ("Simple monitor script for use during development of a Node.js app."), main entry (./lib/nodemon), and forged author field (Remy Sharp, the real maintainer of nodemon) are copied from the legitimate project to appear trustworthy. It was published by npm user conodeeth ([email protected]) as a single release, version 3.1.16, with no prior or subsequent versions.
Its package.json declares tslint-conf@^7.2.1 as a direct runtime dependency — a separately-tracked malicious package (see MAL-2026-7022) that itself masquerades as the pino logger and, when its default-exported middleware factory is invoked, spawns a detached background worker (lib/caller.js) that fetches attacker-controlled code from a Pinata IPFS gateway and executes it via new Function.constructor('require', s), granting full filesystem and environment access.
Static review of nodemon-sudo's own source (all 27 JavaScript files in the published tarball, lib/, bin/, and root) found no require('tslint-conf') or other reference to it anywhere in the package's own code — nodemon-sudo itself does not declare an install hook and does not directly invoke the malicious dependency's trigger. Its role in the attack is to typosquat a high-download-count package name and force the known-malicious tslint-conf onto the dependency tree of anyone who installs it (a dependency-confusion / malicious-dependency-bundling distribution vector), positioning it for exploitation by any other code path in the victim's project that later requires and calls it.
Per SafeDep's analysis, nodemon-sudo is linked to the tslint-conf supply-chain campaign (also distributed via the related, separately-tracked packages nodemon-node — MAL-2026-6957 — and ts-await — MAL-2026-6958), attributed with suspected North Korea-linked tradecraft (lookalike package names, jsonkeeper.com dead drops, JSON-field code execution via the Function constructor, and no reliance on install hooks). Full analysis: https://safedep.io/malicious-nodemon-sudo-tslint-conf-npm-backdoor/
Analysis performed via static review only (npm registry metadata and package source retrieved as text via the npm registry and unpkg CDN) — the package was not installed or executed.
Source: amazon-inspector
Package nodemon-sudo copies upstream nodemon's identity — package.json reuses Remy Sharp as author, https://nodemon.io as homepage, and github.com/remy/nodemon.git as repository, and ships an essentially unmodified copy of nodemon's source. The bin entry is named nodemon, so a global install shadows the real nodemon CLI in the installer's PATH. The manifest additionally declares tslint-conf in dependencies, which is not part of upstream nodemon's dependency set and has no role in nodemon's runtime; installing nodemon-sudo therefore pulls this unrelated third-party package into the installer's node_modules. The package itself was not observed exfiltrating data, executing remote code at install time, or shipping a backdoor — the concern is name-confusion (a developer following a tutorial that suggests sudo may install this instead of nodemon), CLI hijack via the shared nodemon bin name, and the injection of an off-purpose dependency into downstream dependency graphs.
Source: ghsa-malware
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
