Post

you may have heard about a supply chain attack on a number of packages distributed on npm. a quick update: 1. nuxt is not vulnerable. we do not ship code into client/server from these particular packages (this attack required running in the browser) www.aikido.dev/blog/npm-de...

aikido.devnpm debug and chalk packages compromisedThe popular packages debug and chalk on npm have been compromised with malicious code

9/9/25, 7:54 am11 reposts31 likes

Nuxt

@nuxt.com

9 Sept 2025

2. nuxt does not directly depend on these packages. however, it's still possible you might have inadvertently installed them, as some of nuxt's transitive dependencies do depend on some of them. you can see a list here socket.dev/blog/npm-au...

socket.devnpm Author Qix Compromised via Phishing Email in Major Suppl...npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.

Nuxt

@nuxt.com

9 Sept 2025

3. we've put in place a number of best practices, including trusted publishing of our own packages but please be alert - a successful supply chain attack requires only one package in a tree to be affected. docs.npmjs.com/trusted-pub...

docs.npmjs.comTrusted publishing for npm packages | npm DocsDocumentation for the npm registry, website, and command-line interface