The @depup/nuxt npm package version 4.5.0-depup.0 masquerades as a routine Nuxt republish with dependency updates but includes two coordinated malicious modifications. First, it injects a runtime dependency on '@dxup/nuxt', which is not documented and does not exist in the legitimate Nuxt 4.5.0 package. Second, the package's distribution code modifies the Nuxt build process to automatically load '@dxup/nuxt' as a privileged module when experimental.typescriptPlugin is enabled, enabling arbitrary code execution in the build or development context. This attack leverages dependency-graph smuggling under the guise of a familiar Nuxt package.

If a developer installs and uses @depup/nuxt version 4.5.0-depup.0 with experimental.typescriptPlugin enabled, the malicious '@dxup/nuxt' module is auto-loaded with elevated privileges during build or development. This allows attackers to execute arbitrary code in the build environment, potentially compromising the developer's system and any downstream software built with this package. The supply chain compromise undermines trust in the npm ecosystem and can lead to widespread impact if the package is widely used.

No official patch or remediation is currently documented. Users should avoid using the @depup/nuxt package version 4.5.0-depup.0. Verify package authenticity before installation and consider using official Nuxt releases from trusted sources. Monitor vendor advisories and npm security announcements for updates or patches addressing this malicious package. Remove any installations of this package and audit build environments for signs of compromise.