Malicious Code Injection in @anuglar/core Package
Summary
MAL-2026-17541: Malicious code in @anuglar/core (npm). Affects @anuglar/core versions 22.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @anuglar/core package is a malicious npm package that closely resembles the legitimate @angular/core package, which is a core framework for building web applications. This malicious package aims to deceive users by copying the description, author information, and repository URL of the legitimate package, thereby impersonating it. Users may unknowingly install this package, exposing their systems to potential threats.
Vulnerability Detail
The vulnerability arises from a malicious postinstall script in the @anuglar/core package. When installed, this script executes a command that downloads and runs arbitrary JavaScript code from a third-party host (gitflic.ru) via web.archive.org. This code is not verified, meaning it can change at any time, and it runs with the privileges of the user installing the package. The script also performs host reconnaissance by referencing system commands like 'ps' and 'id', which could lead to further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @anuglar/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the @anuglar/core package and ensure that their package.json does not include it. Additionally, regularly audit your dependencies using tools like npm audit to identify and address vulnerabilities.
Conclusion
The @anuglar/core package poses a significant security risk due to its malicious code execution capabilities. Users are strongly advised to uninstall this package and replace it with the legitimate @angular/core package. Regular audits and monitoring of dependencies are essential to maintain a secure development environment.
See every vulnerability recorded for @anuglar/core →
FAQ
The @anuglar/core package is a malicious npm package that impersonates the legitimate @angular/core package, which is used for building web applications.
If the @anuglar/core package is installed, it can execute arbitrary code on your system, potentially leading to data theft, system compromise, or further exploitation.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring access to the code or installation.
You should uninstall the @anuglar/core package immediately and replace it with the legitimate @angular/core package to mitigate the risk.
Regularly audit your dependencies, use tools like npm audit, and verify the authenticity of packages before installation to prevent similar vulnerabilities.
