Malicious code in angulartics2 (npm)

🗓️ 15 Sep 2025 23:49:50Reported by OSSF Malicious PackagesType

ossf🔗 github.com👁 2 Views

Malicious angulartics2 npm package compromises machines and steals tokens, propagating to packages.

Vulners

Node

npm angulartics2Range14.1.1–14.1.2

Source	Link
github	www.github.com/advisories/GHSA-6wgq-85c7-p729
wiz	www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
semgrep	www.semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/
aikido	www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again
stepsecurity	www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised
socket	www.socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

17 Sep 2025 06:23Current

6.9Medium risk

Vulners AI Score6.9