The @depup/nuxt package version 4.5.0-depup.0 on npm contains malicious code that injects an undocumented dependency '@dxup/nuxt', a lookalike package controlled by attackers. This dependency is automatically loaded as a privileged Nuxt module during build or development when the experimental.typescriptPlugin option is enabled, allowing execution of arbitrary code in the build/dev environment. This behavior is hidden from the package's README and change logs, representing a supply chain compromise via dependency-graph smuggling.