nodemon-delog is a malicious npm package that mimics the widely-used nodemon package by replicating its source tree, README, homepage, author, and repository metadata. Unlike nodemon, nodemon-delog declares two runtime dependencies, type-atob and chai, which are not imported or used by its code. These dependencies are installed automatically when nodemon-delog is installed, potentially executing code during installation or require-time. This technique, known as dependency-smuggling, leverages impersonation to introduce unwanted packages into a consumer's dependency tree, posing a supply chain threat. There is no direct evidence of exfiltration or remote code execution within nodemon-delog itself.

The primary impact is the forced installation and potential execution of code from the type-atob and chai packages due to nodemon-delog's dependency declarations. While nodemon-delog does not contain direct malicious payloads, the inclusion of these dependencies without reference in the code can lead to unexpected code execution during installation or runtime, increasing supply chain risk. There are no known exploits in the wild for this package as of the published date.

No official patch or fix is currently available for nodemon-delog. Users should avoid installing nodemon-delog, especially version 3.1.13, and verify package authenticity before installation. Rely on the legitimate nodemon package from trusted sources. Monitor dependency trees for suspicious or unexpected packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.