MAL-2026-13625 Malicious code in @depup/nuxt (npm)

This package presents itself as a routine Nuxt republish with dependency bumps, but ships two coordinated modifications that pull attacker-controlled code into the installer's Nuxt build environment. First, package.json injects a direct runtime dependency on "@dxup/nuxt": "^0.5.3" — a lookalike of the package's own @depup scope — which is not declared in the README or in changes.json among the advertised dep bumps (@nuxt/devtools, @unhead/vue, @vue/shared, devalue, nostics, rolldown-string, undici, unhead, unimport, vue) and does not exist in upstream [email protected]. Second, dist/index.(m)js is tampered to push "@dxup/nuxt" into options._modules when experimental.typescriptPlugin is enabled, so when a consumer uses this package as their nuxt and runs the Nuxt build or dev server, @dxup/nuxt is auto-loaded as a privileged Nuxt module and executes arbitrary code in the build/dev context. The scope name and undocumented injection are consistent with dependency-graph smuggling under cover of a familiar Nuxt republish.