Malicious Code Injection in @qngular/core Package
Summary
MAL-2026-17544: Malicious code in @qngular/core (npm). Affects @qngular/core versions 22.2.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @qngular/core package is a typosquatted version of the legitimate @angular/core package, designed to deceive users into installing it. This package mimics the original's description, author, and repository metadata, making it appear trustworthy. However, it contains malicious code that can compromise the security of the user's system.
Vulnerability Detail
The vulnerability arises from the postinstall lifecycle script in the package.json file, which executes a command to fetch and run a JavaScript payload from an untrusted source (gitflic.ru) via a web.archive.org proxy. This allows an attacker to run arbitrary code on the installer's machine during the npm install process, leading to potential data theft, system compromise, or further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @qngular/coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that your project does not include the @qngular/core package. Regularly audit your dependencies and use tools like npm audit to identify and address vulnerabilities.
Conclusion
The @qngular/core package poses a significant security risk due to its malicious code execution during installation. Users are advised to remove this package and replace it with the legitimate @angular/core package to safeguard their systems. Regular audits and monitoring tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for @qngular/core →
FAQ
A typosquatted package is a malicious package that uses a name similar to a legitimate package, often differing by just a character, to trick users into installing it.
You can check your package.json file or run 'npm list @qngular/core' in your terminal to see if the package is installed in your project.
Using malicious packages can lead to unauthorized access to your system, data breaches, and the potential for further exploitation of your application.
Always verify the authenticity of packages before installation, use trusted sources, and consider using tools like Vulert to monitor your dependencies for vulnerabilities.
Vulert is a service that monitors open-source vulnerabilities in your software using just the package-lock.json file. It provides real-time alerts for any vulnerabilities detected in your dependencies.
