The @depup/astro package published under the @depup scope masquerades as a legitimate dependency-bump of the Astro framework by setting the author to 'withastro' and repository to the official Astro GitHub. However, it replaces well-known Astro dependencies with similarly named lookalike packages controlled by different maintainers (e.g., picocolors replaced by piccolore, debug by obug). The source code is mass-rewritten to import these lookalikes, causing npm install and builds to resolve and execute potentially malicious code from these fake dependencies. The advertised version numbers do not correspond to real upstream releases, and keywords like 'security', 'latest', and 'patched' are used deceptively to normalize these substitutions as legitimate updates.

Users who install and build projects depending on @depup/astro versions =7.1.3-depup.2 or =7.2.0-depup.0 may unknowingly execute malicious code from the substituted lookalike dependencies. This can lead to compromise of the build environment or downstream applications relying on this package. No known exploits in the wild have been reported yet.

No official patch or fix is indicated in the provided data. Users should avoid installing or using the @depup/astro package versions =7.1.3-depup.2 and =7.2.0-depup.0. Verify dependencies carefully to ensure they come from trusted sources and use genuine package names. Monitor vendor advisories or npm security advisories for updates or official remediation guidance.