The 'nodemon-copack' npm package is a malicious impersonation of the legitimate 'nodemon' project. It copies the legitimate project's source and metadata to deceive users. It declares two runtime dependencies, 'regex-js' and 'chai', which are not referenced in the code, indicating a dependency-smuggling technique. This allows potentially malicious code to be introduced via these dependencies during installation. No direct malicious behavior is present in the package itself, but the risk depends on what the smuggled dependencies contain at install time. The package versions =3.1.15 and =3.1.16 are affected. Systems with this package installed should be considered fully compromised, and all secrets and keys should be rotated.

The primary impact is namespace impersonation and the injection of transitive dependencies that may contain malicious code. Although the package itself does not perform exfiltration, remote code execution, or credential access, the smuggled dependencies could introduce such risks. According to the GHSA advisory, any computer with this package installed should be considered fully compromised, necessitating immediate secret and key rotation. Removing the package alone may not eliminate all malicious software resulting from its installation.

There is no official patch or fix available for this malicious package. The recommended mitigation is to immediately remove the 'nodemon-copack' package from any affected systems. Because the package may have compromised the system, all secrets and keys stored on the computer should be rotated from a separate, trusted device. Monitor for any signs of compromise and consider a full system audit or rebuild if this package was installed.