nodemon-sudo backdoor via tslint-conf (no install script)

SafeDep: nodemon-sudo copies real nodemon byte for byte and adds one
extra dependency, tslint-conf — a repackaged pino logger carrying a
backdoor. No install hook. Payload fires only at runtime, one hop
away from the package the developer typed. Same “clean lure + dirty
transitive” pattern as axios/plain-crypto-js (AS22) and Mastra
easy-day-js (AS70).

Mapped techniques

T0129 Typosquatting
T0109 Publish malicious artifact
T0159 Malicious artifact execution

supply-chain clean lure dirty transitive

T0129 · Initial Access · Typosquatting

nodemon-sudo impersonates nodemon.

T0109 · Resource Development · Publish malicious artifact

tslint-conf is the actual backdoor package.

T0159 · Execution · Malicious artifact execution

No postinstall; runs when the logger is required.

Sources

https://safedep.io/malicious-nodemon-sudo-tslint-conf-npm-backdoor