Malicious code in fngularjs (npm)

The fngularjs package in the npm ecosystem has been identified as containing malicious code in specific versions: 1.1.2, 1.1.4, and 8.7.6. This classification is based on the MAL-2026-7287 advisory and GHSA-jqwp-wxcx-95f9 alias. There is no detailed technical information or CVSS score available, and no known exploits have been reported. No vendor advisory or patch information is provided, so the remediation status is unknown.

The presence of malicious code in these specific versions of the fngularjs package could lead to compromise of systems that install or use these versions. The exact impact is not detailed, but malicious packages typically pose risks such as unauthorized code execution, data exfiltration, or supply chain compromise. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance. Until a fix or official guidance is available, avoid using the affected versions (1.1.2, 1.1.4, 8.7.6) of the fngularjs package. Consider using alternative packages or verified safe versions if available.