MAL-2026-17532 Malicious code in @abgular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b Package name @abgular/core is a single-character transposition of @angular/core and copies that package's description, author, and repository metadat...

Malicious code in @angulr/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518 The npm package @angulr/core masquerades as Angular's @angular/core by cloning its package.json metadata description 'Angular - the core framework',...

MAL-2026-17538 Malicious code in @angulr/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518 The npm package @angulr/core masquerades as Angular's @angular/core by cloning its package.json metadata description 'Angular - the core framework',...

Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...

MAL-2026-17541 Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...

Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

MAL-2026-17540 Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

Malicious code in @angupar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84 Package impersonates @angular/core name @angupar/core, author field "angular", repository pointing at github.com/angular/angular, README copied from...

MAL-2026-17539 Malicious code in @angupar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84 Package impersonates @angular/core name @angupar/core, author field "angular", repository pointing at github.com/angular/angular, README copied from...

MAL-2026-17544 Malicious code in @qngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...

Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

MAL-2026-17533 Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

MAL-2026-17529 Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17498 Malicious code in @kibt/www-nuxt-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

MAL-2026-17437 Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

Malicious code in test-agency-assignment-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...

MAL-2026-17297 Malicious code in test-agency-assignment-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...

Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

MAL-2026-17295 Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...