The package name nodemon-gulp impersonates the widely used nodemon package (and collides with the legitimate gulp-nodemon). The tarball is a near-verbatim copy of the real nodemon source with the original author/homepage metadata reused as cover. The manifest declares ts-webplug@^3.0.5 (and chai, normally a devDependency) under dependencies, but neither package is require()d anywhere under lib/ or bin/. Because the deps are unused by the wrapper, their only effect is to be resolved and installed onto any machine that runs npm install nodemon-gulp — the typosquat wrapper is inert, and the installer-facing payload lives in the transitive package ts-webplug, which is silently pulled into the dependency tree. This is the standard typosquat-plus-dependency-injection dropper shape: a familiar-looking clone that exists to deliver an attacker-controlled transitive.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.