Although you show us how you generate the password list, which doesn't seem relevant at all, you don't provide us with sample failing user list data. Your substitution acts on $_ (the default variable) which takes the value of each entry in @nup in turn. If you see an undefined variable warning then most likely there is an undef in @nup nad that implies something bad about your users data.

Try providing a sample user data file with failing data in a __DATA__ section following your sample program. Something like:

use warnings;
use strict;

my @genpass = (1 .. 3);
my @nup = (<DATA>);

foreach (@nup) {
    s/xyz456/$genpass[0]/;
    shift (@genpass);
}

__DATA__
1
2
3
[download]