Six Angular typosquats with postinstall hook pulled from npm

On 5 October GitHub's Advisory Database flagged six npm packages as malware, their scoped names one edit away from @angular/core and @angular/cli. All declared version 22.2.1 and carried a postinstall hook piping a script from gitflic.ru through a web.archive.org proxy. All six have been removed from npm.

• Six packages: @angupar/core, @anngular/core, @abgular/core, @anfular/core, @anguar/core, @angulaar/cli
• All claimed version 22.2.1, matching the real @angular/core release
• Postinstall hook piped a script from gitflic.ru via web.archive.org to bypass filters
• @anguar/core stayed live about five hours: created 4 October, unpublished 5 October