The nodemon-elint package version 3.1.13 is a malicious npm package that impersonates the legitimate nodemon package by copying its metadata and name style. It declares a runtime dependency on an undocumented and unused package, type-elint, which is attacker-controlled and executes code during installation or runtime. This dependency-chain drop technique allows malicious code to run on the installer's machine without visible payloads in the wrapper package itself. The package also incorrectly lists chai, a test library, as a production dependency, indicating anomalous behavior inconsistent with the original nodemon package.