Malicious Code Execution Vulnerability in @angularr/core Package
Summary
MAL-2026-17493: Malicious code in @angularr/core (npm). Affects @angularr/core versions 1.0.67. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @angularr/core package is a malicious variant of the widely-used @angular/core package, which is part of the Angular framework for building web applications. This package is designed to provide core functionalities for Angular applications but has been compromised to execute malicious code during installation.
Vulnerability Detail
The vulnerability arises from the package's npm preinstall lifecycle script, which executes a command that fetches and runs a JavaScript payload from an untrusted third-party host. This occurs every time the package is installed, allowing an attacker to control the code executed on the installer's host. The malicious nature of this code can lead to severe security breaches, including unauthorized access to sensitive data or system compromise.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @angularr/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can monitor your package installations and ensure that you are only using trusted packages. Additionally, consider using tools like Vulert to monitor your dependencies for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The @angularr/core package poses a significant security risk due to its malicious code execution vulnerability. Users are advised to uninstall this package and ensure they are using the legitimate @angular/core package to maintain the security of their applications.
See every vulnerability recorded for @angularr/core →
FAQ
It is a malicious package that mimics the legitimate @angular/core package, designed to execute harmful code during installation.
The vulnerability executes a JavaScript payload from an untrusted source every time the package is installed, compromising the user's system.
You should uninstall the package immediately using the command: npm uninstall @angularr/core.
Always verify package names before installation and use tools like Vulert to monitor your dependencies for vulnerabilities.
No, there is no patch for @angularr/core as it is a malicious package. Use the legitimate @angular/core package instead.
