nodemon-elint (npm) · Malicious Code
Affects nodemon-elintSource GCVE Database
Malicious package : remove nodemon-elint and rotate any secrets on hosts that installed it.
Data as of 14 Jul 2026, 09:47 UTC
Malicious package
Published to npm · OSV MAL-2026-10508
What to do
Remove nodemon-elint from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmnodemon-elint | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The nodemon-elint package version 3.1.13 is a malicious npm package that impersonates the legitimate nodemon package by copying its metadata and name style. It declares a runtime dependency on an undocumented and unused package, type-elint, which is attacker-controlled and executes code during installation or runtime. This dependency-chain drop technique allows malicious code to run on the installer's machine without visible payloads in the wrapper package itself. The package also incorrectly lists chai, a test library, as a production dependency, indicating anomalous behavior inconsistent with the original nodemon package.