Malicious Code Injection in @angularr/router Package
Summary
MAL-2026-17494: Malicious code in @angularr/router (npm). Affects @angularr/router versions 2.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @angularr/router package is a JavaScript library intended for routing in Angular applications. It is designed to facilitate navigation and manage the application's state. However, this package has been found to contain malicious code that poses significant security risks to users who install it.
Vulnerability Detail
The vulnerability originates from the package's preinstall script, which executes a command that fetches and runs a JavaScript payload from an unverified third-party source. This payload is executed with the installer's privileges before any legitimate package code is loaded, allowing for potential malicious actions such as data theft or unauthorized access. The package name closely resembles the legitimate @angular/router package, which can mislead users into installing it, thus increasing the risk of exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @angularr/routerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @angularr/router package and consider using the official @angular/router package instead. You can install it using the following command: npm install @angular/router.
Conclusion
The @angularr/router package poses a significant security risk due to its embedded malicious code. Users are advised to uninstall this package immediately and switch to verified alternatives. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for @angularr/router →
FAQ
Using the @angularr/router package can lead to the execution of malicious code on your system, potentially compromising sensitive data and system integrity.
You can use tools like Vulert to monitor and alert you for open-source vulnerabilities in your software. Check your package-lock.json file with Vulert's playground at Vulert Scanner.
If you have installed the @angularr/router package, you should immediately uninstall it and replace it with a legitimate alternative, such as @angular/router.
The malicious code is executed through a preinstall script that fetches a JavaScript payload from an unverified source and pipes it directly into Node for execution.
No, there is no patched version of the @angularr/router package. It is recommended to uninstall it and use a legitimate alternative.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
