Executive Summary
A sophisticated open-source supply chain attack has been identified involving the npm package `nodemon-sudo` (v3.1.16). This package impersonates the popular `nodemon` utility by providing a verbatim copy of its code but injecting a malicious dependency, `tslint-conf`. This campaign, tracked as the 'emiltype/jsonspack' campaign, is notable for bypassing traditional install-time scanners by omitting install scripts (preinstall/postinstall) and only triggering the malicious payload during runtime application execution.
Technically, the backdoor within `tslint-conf` (v7.2.1) functions as a repackaged `pino` logger. When invoked as middleware, it spawns a detached Node.js process that fetches a second-stage payload from an IPFS gateway. This payload is executed using the `Function` constructor, granting it full access to the host's filesystem and environment variables. The tradecraft closely resembles tactics attributed to North Korean-linked clusters, though direct attribution remains unconfirmed.
This threat poses a significant risk to developers and organizations utilizing unverified npm packages. Because the malicious behavior only manifests at runtime and is hidden one dependency hop away from the top-level package, it requires deep dependency analysis and runtime monitoring to detect. Immediate removal and credential rotation are advised for any system where these packages were introduced.