The nodemon-gulp npm package is a typosquatting malicious package designed to impersonate the legitimate nodemon package and collide with gulp-nodemon. While the package itself is mostly inert, it declares dependencies including ts-webplug and chai, which are not used by the package code but are installed transitively. The ts-webplug package contains the malicious payload, effectively making nodemon-gulp a dropper for attacker-controlled code. Any system that installs nodemon-gulp version 3.1.16 is at risk of full compromise, as the malicious transitive dependency can execute arbitrary code and potentially take full control of the machine.

Systems that have nodemon-gulp version 3.1.16 installed should be considered fully compromised. The malicious transitive dependency can execute arbitrary code, potentially allowing attackers full control over the affected system. All secrets and keys stored on the compromised system are at risk and must be rotated immediately from a secure environment. Removal of the package alone may not eliminate all malicious components or backdoors installed as a result of the compromise.

No official fix or patch is available for nodemon-gulp version 3.1.16, as this is a malicious package rather than a traditional vulnerability. The recommended mitigation is to immediately remove the nodemon-gulp package from any affected systems. Additionally, all secrets, keys, and credentials stored on the compromised machines should be rotated from a different, secure system. Because the attacker may have persistent access, further forensic analysis and system remediation may be necessary to ensure full removal of malicious artifacts.