registry / @depup/nuxt / 4.5.2-depup.1

@depup/nuxt@4.5.2-depup.1

Nuxt is a free and open-source framework with an intuitive and extendable way to create type-safe, performant and production-grade full-stack web applications and websites with Vue.js. (with updated dependencies)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 88.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 145 file(s), 952 KB of source, external domains: github.com, nuxt.com, ui.perfetto.dev, www.npmjs.com

Source & flagged code

3 flagged

dist/app/composables/payload.jsView file

Lines 76-116javascript

76 const u = new URL(url, "http://localhost");

77 if (u.host !== "localhost" || hasProtocol(u.pathname, { acceptRelative: true })) throw stateDiagnostics.NUXT_E7001({ url });

78 const config = /* @__PURE__ */ useRuntimeConfig();

79 const hash = opts.hash || (opts.fresh || import.meta.dev ? Date.now() : config.app.buildId);

80 const cdnURL = config.app.cdnURL;

81 const baseOrCdnURL = cdnURL && await isPrerendered(url) ? cdnURL : config.app.baseURL;

82 const payloadURL = joinURL(baseOrCdnURL, u.pathname, filename);

83 if (!isCachedPayloadRoute(url)) u.search = "";

84 if (hash) u.searchParams.set(payloadBuildIdParam, String(hash));

85 return payloadURL + u.search;

86}

87async function _importPayload(payloadURL, cache) {

88 if (import.meta.server || !payloadExtraction) return null;

89 try {

90 if (renderJsonPayloads) {

91 const res = await fetch(payloadURL, import.meta.dev ? {} : { cache });

92 if (!res.ok) {

93 if (import.meta.dev) stateDiagnostics.NUXT_E7002({ url: payloadURL });

94 return null;

95 }

96 return await parsePayload(await res.text());

97 } else return await import(

98 /* webpackIgnore: true */

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/composables/payload.jsView on unpkg · L96

99 /* @vite-ignore */

100 payloadURL

101).then((r) => r.default || r);

102 } catch (err) {

103 stateDiagnostics.NUXT_E7002({

104 url: payloadURL,

105 cause: err

106 });

107 }

108 return null;

109}

110function _shouldLoadPrerenderedPayload(rules) {

111 if (rules.redirect) return false;

112 if (rules.prerender) return true;

113}

114function _getRoutePath(url) {

115 return new URL(url, "http://localhost").pathname;

116}

dist/index.mjsView file

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist/index.mjs: import fs, { existsSync, mkdirSync, promises, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs"; import { mkdir, open, readFile, readdir, rm, stat, unlink, writeFile } from "node:fs/promises"; const NUXT_LIB_RE = /^[^?]*node_modules\/(?:nuxt|nuxt3|nuxt-nightly|@nuxt)\//; async beforeWriteFiles(rootPage) { const UNHEAD_LIB_RE = /node_modules[/\\](?:@unhead[/\\][^/\\]+|unhead)[/\\]/; const NUXT_HEAD_RE = /node_modules[/\\]nuxt[/\\]dist[/\\]head[/\\]runtime[/\\]/; if (!normalize(id).includes("node_modules")) headDiagnostics.NUXT_B6001({ if (!mod.meta?.rawPath) link = `https://www.npmjs.com/package/${importName}`;

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist/index.mjsView on unpkg

dist/index.jsView file

•matchType = package_source_clone_identity_mismatch matchedPackage = nuxt@4.5.2 matchedPath = bin/nuxt.mjs matchedIdentity = npm:bnV4dA:4.5.2 similarity = 1.000 shingleOverlap = 80 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

dist/index.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/app/composables/payload.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code