Malicious Code Injection in @angulr/core: A Critical Security Threat
Summary
MAL-2026-17538: Malicious code in @angulr/core (npm). Affects @angulr/core versions 22.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The npm package @angulr/core is a malicious clone of Angular's legitimate @angular/core package. It falsely represents itself by mimicking the original package's metadata, including its description, author, and repository. This package is designed to deceive developers into installing it, leading to severe security risks due to its hostile postinstall script.
Vulnerability Detail
The vulnerability arises from a malicious postinstall script included in the @angulr/core package. When a developer runs 'npm install @angulr/core', the script executes a command that fetches and runs unverified JavaScript code from an external source (https://gitflic.ru). This poses a significant risk as it allows the execution of attacker-controlled code with the privileges of the installer, leading to potential data breaches, system compromises, and unauthorized access.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @angulr/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can use the following command to uninstall the malicious package and ensure you are using the correct Angular package: 'npm uninstall @angulr/core && npm install @angular/core'. Additionally, consider using Vulert to monitor your project for vulnerabilities in real-time.
Conclusion
The @angulr/core package poses a significant security threat due to its malicious code execution capabilities. Developers must be vigilant in verifying package authenticity and should utilize tools like Vulert to monitor for vulnerabilities. Immediate action is required to mitigate risks associated with this malicious package.
See every vulnerability recorded for @angulr/core →
FAQ
@angulr/core is a malicious npm package that pretends to be Angular's core framework package, @angular/core.
The vulnerability allows the execution of malicious code on your system, potentially leading to data theft, system compromise, or unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed @angulr/core, you should uninstall it immediately using 'npm uninstall @angulr/core' and install the legitimate @angular/core package.
To prevent similar vulnerabilities, always verify package integrity, use trusted sources, and consider using monitoring tools like Vulert.
