Malicious code in nodemon-patch (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15ac606888cb1a54710bafa78dc76d760bef1088bb5e2cc0f0323614341345e5) The package is named `nodemon-patch` but its package.json metadata (homepage https://nodemon.io, author Remy Sharp / github.com/remy, repository, funding) and lib/ source are copied verbatim from the legitimate `nodemon` package by Remy Sharp. The package author has not published nodemon and the name is a single-suffix variant of a top-100 npm package, consistent with namespace impersonation. The local lib/ code mirrors upstream nodemon and is functionally benign on its own, but package.json declares a runtime dependency on `webpack-patch@^1.1.7` — a similarly-shaped `*-patch` name that is not a dependency of real nodemon and does not correspond to any established OSS library — plus `chai` as a runtime (not dev) dependency. Any developer who runs `npm i nodemon-patch` expecting nodemon will silently pull `webpack-patch` into their dependency tree, where its install/require-time code would execute. The combination of cloned identity metadata + a same-suffix sibling dependency with no legitimate provenance is the namespace-abuse / dropper-lure shape, but confirming installer harm requires inspecting webpack-patch itself. ## Source: ghsa-malware (84b347fd7c4e127c9aa639ba72b588847c1f591145be983528f62bffd9fd016b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The nodemon-patch package in the npm ecosystem is identified as containing malicious code that results in a full system compromise upon installation or execution. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and must be rotated from a separate, uncompromised device. Due to the depth of control gained by the attacker, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. No CVSS score or patch information is available, and no known exploits in the wild have been reported at this time.
Potential Impact
Any system with the nodemon-patch package installed or running is fully compromised, meaning an attacker can potentially control the system and access all stored secrets and keys. This poses a critical security risk including potential data theft, unauthorized access, and persistent malicious presence on the device.
Mitigation Recommendations
Remove the nodemon-patch package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised machines, performing this rotation from a separate, trusted device. Because full control may have been given to an attacker, consider the affected systems untrusted and perform thorough forensic analysis and remediation beyond just package removal. No official patch or fix is available; the best mitigation is removal and credential rotation.
Malicious code in nodemon-patch (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (15ac606888cb1a54710bafa78dc76d760bef1088bb5e2cc0f0323614341345e5) The package is named `nodemon-patch` but its package.json metadata (homepage https://nodemon.io, author Remy Sharp / github.com/remy, repository, funding) and lib/ source are copied verbatim from the legitimate `nodemon` package by Remy Sharp. The package author has not published nodemon and the name is a single-suffix variant of a top-100 npm package, consistent with namespace impersonation. The local lib/ code mirrors upstream nodemon and is functionally benign on its own, but package.json declares a runtime dependency on `webpack-patch@^1.1.7` — a similarly-shaped `*-patch` name that is not a dependency of real nodemon and does not correspond to any established OSS library — plus `chai` as a runtime (not dev) dependency. Any developer who runs `npm i nodemon-patch` expecting nodemon will silently pull `webpack-patch` into their dependency tree, where its install/require-time code would execute. The combination of cloned identity metadata + a same-suffix sibling dependency with no legitimate provenance is the namespace-abuse / dropper-lure shape, but confirming installer harm requires inspecting webpack-patch itself. ## Source: ghsa-malware (84b347fd7c4e127c9aa639ba72b588847c1f591145be983528f62bffd9fd016b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nodemon-patch package in the npm ecosystem is identified as containing malicious code that results in a full system compromise upon installation or execution. The compromise is severe enough that all secrets and keys on the affected system should be considered exposed and must be rotated from a separate, uncompromised device. Due to the depth of control gained by the attacker, simply uninstalling the package may not remove all malicious artifacts or backdoors introduced. No CVSS score or patch information is available, and no known exploits in the wild have been reported at this time.
Potential Impact
Any system with the nodemon-patch package installed or running is fully compromised, meaning an attacker can potentially control the system and access all stored secrets and keys. This poses a critical security risk including potential data theft, unauthorized access, and persistent malicious presence on the device.
Mitigation Recommendations
Remove the nodemon-patch package immediately from all affected systems. Rotate all secrets, keys, and credentials that were stored on the compromised machines, performing this rotation from a separate, trusted device. Because full control may have been given to an attacker, consider the affected systems untrusted and perform thorough forensic analysis and remediation beyond just package removal. No official patch or fix is available; the best mitigation is removal and credential rotation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-10110
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-5v8m-v9mp-gf8h"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a50ba3268715ace4357d27d
Added to database: 07/10/2026, 09:24:02 UTC
Last enriched: 07/10/2026, 09:30:30 UTC
Last updated: 07/28/2026, 10:07:59 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.