Malicious Code Execution Vulnerability in @angulaar/core Package
Summary
MAL-2026-17537: Malicious code in @angulaar/core (npm). Affects @angulaar/core versions 22.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angulaar/core package is a JavaScript library that mimics the popular Angular framework. It is designed for building web applications but has been identified as potentially harmful due to its misleading name, which closely resembles @angular/core. This similarity increases the risk of accidental installation by developers who may confuse the two packages.
Vulnerability Detail
The vulnerability arises from a postinstall lifecycle script defined in the package's package.json file. This script fetches a JavaScript file from a non-publisher host (gitflic.ru) and executes it directly on the installer's machine during the npm install process. The fetched code is unverified and controlled by a third-party account, allowing for arbitrary remote code execution. This poses significant security risks, including data theft and system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @angulaar/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no direct workarounds for this vulnerability other than avoiding the installation of the @angulaar/core package. If you have already installed it, ensure to remove it immediately and replace it with the legitimate @angular/core package.
Conclusion
The @angulaar/core package poses a significant security risk due to its malicious code execution vulnerability. It is essential to avoid this package and use the legitimate @angular/core package instead. Regularly monitoring your dependencies with tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for @angulaar/core →
FAQ
The primary risk is the execution of arbitrary malicious code on the user's machine during installation, which can lead to severe security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, Vulert can help you identify if your application is affected.
No, there is no patched version of the @angulaar/core package. It is recommended to completely avoid this package and use the official @angular/core instead.
You should uninstall the package immediately using the command npm uninstall @angulaar/core and replace it with the official @angular/core package.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
