The npm package 'nodemon-lint' version 3.1.15 is a malicious package masquerading as the legitimate 'nodemon' package. It copies the legitimate nodemon's code and metadata but adds unused runtime dependencies that may contain malicious code. Installing this package can lead to a full compromise of the affected system, potentially exposing all stored secrets and keys. Immediate removal and secret rotation are strongly advised.