@nuxt/devtools

The Nuxt DevTools gives you insights and transparency about your Nuxt App.

Latest 4.0.0-beta.4

NPM

80%

Total Score

healthy

Active maintenance and strong project backing outweigh the beta status and mostly unpinned workflow actions.

Are you affected? Scan for Free

Health Score Breakdown

Dependency profile

The package has 27 runtime dependencies, a sizeable integration surface for a developer tool, but the signal provides no evidence of unsafe or abandoned dependencies.

Maintainers

The package has five publish-access accounts and is backed by an organization, which supports continuity; atinux, pi0, and antfu publish through consumer email accounts, creating a minor account-hygiene concern rather than evidence of limited maintenance capacity.

Version stability

Version 4.0.0-beta.4 is explicitly a prerelease, and 80% of recent versions are prereleases, so API and behavior stability remain a genuine adoption concern.

Workflow audit

All 6 workflows were analyzed with no high- or medium-severity findings, no untrusted checkouts, and no script injection. However, 42 of 43 action references are unpinned and high-confidence adhoc-package findings appear across several workflows, so workflow reproducibility and hygiene warrant caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-72858 @nuxt/devtools is vulnerable to Remote Code Execution (RCE) in versions 0.0.1 - 3.3.0.	0.0.1 - 3.3.0	Critical
CVE-2025-52662 @nuxt/devtools is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.6.4.	0.0.0 - 2.6.4	Medium
CVE-2024-23657 @nuxt/devtools is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 1.3.9.	0.0.0 - 1.3.9	High