`nodemon-sudo` v3.1.16 is a malicious npm lookalike that copies legitimate nodemon while adding an unused dependency on `tslint-conf`, a repackaged pino logger containing the backdoor. The payload avoids install hooks and import-time execution; it runs only when the fake logger middleware is called, spawning a detached Node process that fetches JavaScript from a Pinata IPFS gateway and executes it with real `require` access. SafeDep links the package pair to earlier `nodemon-node` and `ts-await` activity through reused code, IPFS and jsonkeeper infrastructure, and notes a resemblance to a North Korea-linked npm cluster documented elsewhere, but states that attribution is technique-based and not confirmed.