[email protected] is a typosquatting malicious package that mimics the legitimate nodemon package's metadata to deceive users. It forces installation of a sibling package, type-elint@^3.3.7, which is not used or imported by nodemon-elint but may contain malicious install-time or runtime code that executes on the user's machine. This indirect dependency-chain drop technique allows attackers to deliver malicious payloads via npm install without direct payloads in nodemon-elint itself. The presence of chai@^4.4.1 as a production dependency further indicates suspicious package composition inconsistent with upstream nodemon.

Installing [email protected] causes npm to install an attacker-controlled package, type-elint, which may execute malicious code during installation or runtime on the user's machine. This can lead to compromise of the development environment or further supply chain attacks. The wrapper package itself contains no direct payload, making detection harder. There are no known exploits in the wild reported at this time.

Avoid installing [email protected] or any similarly named packages that impersonate legitimate ones. Use official package names and verify package authenticity before installation. Since no official fix or patch is available, the best mitigation is to remove the malicious package from dependency trees and rely on trusted sources. Monitor npm package registries and advisories for updates or removals of this package.