MAL-2026-10507

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ea1c5b4054d6daffaf190005db661027e29255ae20de1bb410f506de1f178532) nodemon-delog is published under a name that resembles the widely-used `nodemon` package and ships a verbatim copy of nodemon's source tree, README, homepage (nodemon.io), author (Remy Sharp), and repository metadata (github.com/remy/nodemon), presenting itself as the real project. Its package.json declares two runtime dependencies that upstream nodemon does not use and that no file under lib/ or bin/ references: `type-atob` and `chai`. Because these are declared under `dependencies`, they are resolved and installed into the consumer's node_modules on `npm install nodemon-delog`, regardless of the fact that nodemon-delog's own code never imports them. The lure package itself contains no exfiltration or RCE code; the harm mechanism is the forced resolution of the sibling packages into the installer's dependency tree, where their install/require-time code will execute. The impersonation of an established package, combined with the presence of runtime dependencies unrelated to the advertised functionality and unreferenced by any shipped file, is the dependency-smuggling lure pattern.