Malicious code in @depup/nuxt (npm)

The npm package @depup/nuxt was published with coordinated malicious modifications disguised as a routine Nuxt republish with dependency updates. The package's package.json injects a direct runtime dependency on "@dxup/nuxt" (version ^0.5.3), a lookalike package in a different scope, which is not listed in the advertised dependency bumps or README.\n\nThe second stage of the attack modifies dist/index.(m)js to inject "@dxup/nuxt" into the options._modules array when experimental.typescriptPlugin is enabled. This causes the attacker-controlled module to be auto-loaded as a privileged Nuxt module whenever a consumer uses @depup/nuxt and runs the Nuxt build or dev server, allowing arbitrary code execution in the build/dev environment.\n\nThe attack pattern—using a similar scope name, undocumented injection, and hiding the malicious dependency among legitimate updates—is consistent with dependency-graph smuggling tactics. The incident was identified and credited to the OpenSSF's malicious-packages repository.