MAL-2026-17537

    Dashboard / Malicious Package / MAL-2026-17537

    MAL-2026-17537

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in @angulaar/core (npm)

    Details: Source: amazon-inspector (42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792) The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host (gitflic.ru, proxied via web.archive.org, at the path /project/hellscripter/install-scripts/blob/raw?file=node.js) and pipes the response directly into node, executing arbitrary remote code on the installer's machine during npm install. The fetched code is unpinned, unverified, and controlled by a third-party account unrelated to the Angular project. The package name @angulaar/core resembles @angular/core, increasing the likelihood of accidental installation.

    References: https://www.npmjs.com/package/@angulaar/core/v/22.2.1

    Affected packages

    Package

    Name: @angulaar/core

    Purl: pkg:npm/%40angulaar/core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    22.2.1