@nuxt/ui
A UI Library for Modern Web Apps, powered by Vue & Tailwind CSS.
86%
Total Score
healthy
Healthy: frequent releases and active repository maintenance outweigh unpinned CI actions.
Health Score Breakdown
All 31 analyzed action references are unpinned, creating a genuine workflow reproducibility and supply-chain hygiene caution. The audit also reports a low-confidence high-severity cache-poisoning pattern, but no untrusted checkout or script-injection paths, so it does not independently make the package unsafe.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10096 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. @nuxt/ui is vulnerable to Cross-site Scripting (XSS) in versions 4.0.0 - 4.3.0. | 4.0.0 - 4.3.0 | Medium |
Package versions
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 ufo Version ^1.6.4 | — | — |
defu Version ^6.1.7 | — | — |
mlly Version ^1.8.2 | — | — |
ohash Version ^2.0.12 | — | — |
pathe Version ^2.0.3 | — | — |
Weekly Downloads
Info
- Last Published
- 13 days ago
- Created
- 4 years ago
- Unpacked Size
- 2.6 MB
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.