@angulaar/core

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (42861c7641349d2f58380e4f81b13ad9738dd254f224e9f7f239d9cf940cf792)
The package's package.json defines a postinstall lifecycle script that fetches a JavaScript file from a non-publisher host (gitflic.ru, proxied via web.archive.org, at the path /project/hellscripter/install-scripts/blob/raw?file=node.js) and pipes the response directly into node, executing arbitrary remote code on the installer's machine during npm install. The fetched code is unpinned, unverified, and controlled by a third-party account unrelated to the Angular project. The package name @angulaar/core resembles @angular/core, increasing the likelihood of accidental installation.

Compromised versions (1)

• 22.2.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.