Which versions of angularbs are malicious?

The following npm versions of angularbs are flagged malicious: 8.7.6. Treat any of these as compromised.

How do I remediate angularbs if I installed it?

Remove angularbs from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

I already installed angularbs — how do I know if it already compromised me?

If angularbs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is angularbs part of a known attack campaign?

Yes — angularbs is associated with the RLMA-2026-04861, RLUA-2026-05996 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find angularbs across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for angularbs (version 8.7.6).

Malicious package

angularbsnpm

Advisory published Jul 7, 2026Updated Sep 1, 2026

angularbs is a confirmed malicious npm package (MAL-2026-7141) that executes malicious code on install (malicious version 8.7.6). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in angularbs (npm)

MAL-2026-7141

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall angularbs

Malicious versions

1 flagged

8.7.6

Indicators of compromise (SHA-256)

4c22dc5fc9a3a9ed9efac18b409e8dd969ed31455411d8ca5f2799b1f63d249a

01ac1651da426121f8d481612ca7a808dd76966f620367940f09f60d668a4136

Detection & response playbook

Malicious package

Find it
Search your lockfiles and build artifacts for angularbs (version 8.7.6).
If you installed it — respond
Remove angularbs from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.
Did it already run?
If angularbs was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. angularbs on npm has been identified as a malicious package (version 8.7.6 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

RLMA-2026-04861RLUA-2026-05996

References

github.com

Credits

ReversingLabs · finder

Detect & block this

O3 blocks angularbs-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database