{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "dist/index.js",
              "sha256": "932f6e8ddb11482a526932eed9685a1c3f5b6af4e530b8f585d333da96efa867",
              "tlsh": "f064e8b1e79c371606f531d9993d40cfa9bcc272790dc8a6becc67f4268381dc2a6a54"
            },
            {
              "path": "package.json",
              "sha256": "c5f100fcd5423d49b5682e5f6ca4e2865366956845cbfb4980ffd0c3e9dbe0de",
              "tlsh": "cfc1bc24cca4cdd308d422f5a82a1142a61451874e18fd1c37dd47adaf0d6af32bfbae"
            }
          ],
          "package_integrity": [
            {
              "filename": "nuxt-4.5.0-depup.0.tgz",
              "hashes": {
                "sha1": "3d644d49e6a5f9efac21010f70a68e3e98325a67",
                "sha512_sri": "sha512-hlKOjd3YN3Yk6BfQB8Ok4lq4ktmgrmPbOHsLtfaeyHEGFL+YIFP5NqDBZqF0BSvyId7qQd1fK8Tfr3TWqpmMHQ=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "@depup/nuxt"
      },
      "versions": [
        "4.5.0-depup.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-017131",
        "import_time": "2026-08-07T17:51:00.158602597Z",
        "modified_time": "2026-08-07T17:25:02Z",
        "sha256": "b0811cc3f28ee89cf1ab9a44155c55f9f590f4692bad740986dc00b67dbb8bb3",
        "source": "amazon-inspector",
        "versions": [
          "4.5.0-depup.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b0811cc3f28ee89cf1ab9a44155c55f9f590f4692bad740986dc00b67dbb8bb3)\nThis package presents itself as a routine Nuxt republish with dependency bumps, but ships two coordinated modifications that pull attacker-controlled code into the installer\u0027s Nuxt build environment. First, package.json injects a direct runtime dependency on \"@dxup/nuxt\": \"^0.5.3\" \u2014 a lookalike of the package\u0027s own @depup scope \u2014 which is not declared in the README or in changes.json among the advertised dep bumps (@nuxt/devtools, @unhead/vue, @vue/shared, devalue, nostics, rolldown-string, undici, unhead, unimport, vue) and does not exist in upstream nuxt@4.5.0. Second, dist/index.(m)js is tampered to push \"@dxup/nuxt\" into options._modules when experimental.typescriptPlugin is enabled, so when a consumer uses this package as their nuxt and runs the Nuxt build or dev server, @dxup/nuxt is auto-loaded as a privileged Nuxt module and executes arbitrary code in the build/dev context. The scope name and undocumented injection are consistent with dependency-graph smuggling under cover of a familiar Nuxt republish.\n",
  "id": "MAL-2026-13625",
  "modified": "2026-08-07T17:25:02Z",
  "published": "2026-08-07T17:25:02Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/@depup/nuxt/v/4.5.0-depup.0"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in @depup/nuxt (npm)"
}