Coordinated malicious npm typosquat cluster (internally tracked as emiltype/jsonspack, linked to a North Korea-associated npm campaign). nodemon-sudo impersonates the popular nodemon process monitor; the packages fetch a second-stage payload from an IPFS gateway and execute it via Node require (remote code execution), triggered at runtime when a disguised logger is called rather than on install to evade scanners. Payload targets browser cookie and credential-database theft. Published 2026-07-07 and removed by the npm security team (replaced with 0.0.1-security holding placeholders). All versions affected. tslint-conf has OSV advisory MAL-2026-7022.