MAL-2026-13625

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@depup/nuxt/MAL-2026-13625.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13625
Published
2026-08-07T17:25:02Z
Modified
2026-08-07T18:05:07.616176961Z
Summary
Malicious code in @depup/nuxt (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b0811cc3f28ee89cf1ab9a44155c55f9f590f4692bad740986dc00b67dbb8bb3)

This package presents itself as a routine Nuxt republish with dependency bumps, but ships two coordinated modifications that pull attacker-controlled code into the installer's Nuxt build environment. First, package.json injects a direct runtime dependency on "@dxup/nuxt": "^0.5.3" — a lookalike of the package's own @depup scope — which is not declared in the README or in changes.json among the advertised dep bumps (@nuxt/devtools, @unhead/vue, @vue/shared, devalue, nostics, rolldown-string, undici, unhead, unimport, vue) and does not exist in upstream nuxt@4.5.0. Second, dist/index.(m)js is tampered to push "@dxup/nuxt" into options._modules when experimental.typescriptPlugin is enabled, so when a consumer uses this package as their nuxt and runs the Nuxt build or dev server, @dxup/nuxt is auto-loaded as a privileged Nuxt module and executes arbitrary code in the build/dev context. The scope name and undocumented injection are consistent with dependency-graph smuggling under cover of a familiar Nuxt republish.

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "4.5.0-depup.0"
            ],
            "import_time": "2026-08-07T17:51:00.158602597Z",
            "sha256": "b0811cc3f28ee89cf1ab9a44155c55f9f590f4692bad740986dc00b67dbb8bb3",
            "modified_time": "2026-08-07T17:25:02Z",
            "id": "IN-MAL-2026-017131",
            "source": "amazon-inspector"
        }
    ]
}
References
Credits

Affected packages

npm / @depup/nuxt

Package

Name
@depup/nuxt
View open source insights on deps.dev
Purl
pkg:npm/%40depup/nuxt

Affected ranges

Affected versions

4.*
4.5.0-depup.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-hlKOjd3YN3Yk6BfQB8Ok4lq4ktmgrmPbOHsLtfaeyHEGFL+YIFP5NqDBZqF0BSvyId7qQd1fK8Tfr3TWqpmMHQ==",
                "sha1": "3d644d49e6a5f9efac21010f70a68e3e98325a67"
            },
            "filename": "nuxt-4.5.0-depup.0.tgz"
        }
    ],
    "evidence_files": [
        {
            "path": "dist/index.js",
            "sha256": "932f6e8ddb11482a526932eed9685a1c3f5b6af4e530b8f585d333da96efa867",
            "tlsh": "f064e8b1e79c371606f531d9993d40cfa9bcc272790dc8a6becc67f4268381dc2a6a54"
        },
        {
            "path": "package.json",
            "sha256": "c5f100fcd5423d49b5682e5f6ca4e2865366956845cbfb4980ffd0c3e9dbe0de",
            "tlsh": "cfc1bc24cca4cdd308d422f5a82a1142a61451874e18fd1c37dd47adaf0d6af32bfbae"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@depup/nuxt/MAL-2026-13625.json"