MAL-2026-17536 Malicious code in @angulaar/cli (npm)
Malicious package
Published
MAL-2026-17536 is a malicious package: @angulaar/cli (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-17536/ (Markdown: https://insights.sbomify.com/MAL-2026-17536/index.md)
- Package
- @angulaar/cli
- Registry
- npm
What is MAL-2026-17536?
MAL-2026-17536 is a malicious package in @angulaar/cli, published on 5 Oct 2026.
Official description
Package name '@angulaar/cli' (double 'a') is a one-character edit of '@angular/cli'; README, LICENSE headers, and source files are copied verbatim from the real Angular CLI (Google LLC copyright, angular.dev license URLs, README pointing issues to github.com/angular/angular-cli). The manifest's dependencies list has been altered from the upstream package: real @angular/cli depends on '@modelcontextprotocol/sdk', while this package declares '@modelcontextprotocol/server': '2.0.0' and requires it from src/commands/mcp/cli.js and mcp-server.js. '@modelcontextprotocol/server' is not the official MCP package name, so npm install resolves and installs whatever bytes are published under that attacker-chosen name/version, executing any lifecycle scripts in that dependency on the installer's host and loading its code in-process on later
ng mcp invocations. The lookalike package name, cloned source, and swapped MCP dependency together form a dependency-confusion delivery vector against developers who mistype the real @angular/cli name.What should I do about MAL-2026-17536?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.