npm install of forged nodemon-sudo/tslint-conf packages (v3.1.16/v7.2.1)

Ethan Andrews@eandrews

•updated Jul 9, 2026•7•0•12

Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.