GCVE-110-OSM-2026-13107

package.json:62 contains a preinstall hook that curl-pipes a remote script from gitflic.ru (via web.archive.org) directly into node, executing attacker-controlled code at install time. Combined with the typosquatted name '@angularr/cli' mimicking '@angular/cli', this is install-stage malware. ## Key findings - [critical] Malicious install script — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: unknown - Install hooks: none found - SHA-256 (tarball): `n/a (tarball not retained)` - Registry metadata: unavailable (package likely removed from npm) ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org