Nuxt

registrynpm

package namenuxt

maintainerNuxt Contributors

Nuxt is the Vue.js full-stack framework providing file-based routing, server-side rendering, and API routes using Nitro. It is the dominant full-stack framework in the Vue ecosystem, used in production applications that combine Vue on the client with Nitro on the server.

api usage

Checking Nuxt

nuxt 3.13.0 is a clean, monitored version with no known supply chain compromise. The example response returns supply_chain_monitored: true and compromised: false with an empty sources array.

bash

curl "https://api.attestd.io/v1/check?product=nuxt&version=3.13.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

example response

json

{
  "product": "nuxt",
  "version": "3.13.0",
  "supported": true,
  "risk_state": "none",
  "risk_factors": [],
  "actively_exploited": false,
  "remote_exploitable": false,
  "authentication_required": false,
  "patch_available": false,
  "fixed_version": null,
  "confidence": 0.9,
  "cve_ids": [],
  "cves": null,
  "max_epss": null,
  "typosquat": null,
  "supply_chain_monitored": true,
  "supply_chain": {
    "compromised": false,
    "sources": [],
    "malware_type": null,
    "description": null,
    "advisory_url": null,
    "compromised_at": null,
    "removed_at": null
  },
  "last_updated": "2026-05-01T00:00:00Z"
}

attack surface

Why this package is monitored

Nuxt's Nitro server holds env vars and backend resources while generating Vue client code. Compromise spans both the server request path and the browser bundle.

Attestd monitors nuxt using the following detection sources:

registry

Manually curated advisories in the Attestd registry, verified by a human analyst. Confidence 1.0.

osv

OSV.dev malicious-package advisories with IDs prefixed MAL-. Confidence 0.95.

npm_deprecation

npm package versions with deprecation messages containing targeted attack language such as malicious, backdoor, or compromised. Confidence 0.80.

Supply chain overview All npm packages Express Prisma Client Response fields