@angular/core — Greenflagged

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

angulargoogle-wombot

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
source-diff	net-exec-file:schematics/bundles/project_tsconfig_paths-Cu6YNBK3.cjs	AI (source-diff): Schematics bundle using fs/path/url/typescript — standard Angular migration tooling, not malware.	ai	2026/06/11
source-diff	net-exec-file:schematics/bundles/checker-D2h8Lo1k.cjs	AI (source-diff): Angular schematics bundle importing node builtins (fs, path, url, os) + typescript; standard migration tooling.	ai	2026/06/01
source-diff	net-exec-file:schematics/bundles/project_tsconfig_paths-D0pvNjuF.cjs	AI (source-diff): Standard Angular schematics bundle importing Node builtins (fs, path, url, typescript); not malicious.	ai	2026/06/01
source-diff	obfuscated-file:fesm2022/debug_node.mjs	AI (source-diff): Long import lines in Angular FESM bundles are normal, not obfuscation.	ai	2026/06/01
source-diff	net-exec-file:schematics/bundles/project_tsconfig_paths-DkhzVMGt.cjs	AI (source-diff): Standard Angular schematics bundle importing fs/path/url/typescript; no malicious payload.	ai	2026/06/01
publish-pattern	rapid-publish	AI (publish-pattern): Angular publishes many scoped packages in rapid succession from CI; expected pattern.	ai	2026/06/01
source-diff	obfuscated-file:fesm2022/root_effect_scheduler.mjs	AI (source-diff): Long import lines in Angular FESM bundles are normal, not obfuscation.	ai	2026/06/01
source-diff	net-exec-file:schematics/bundles/checker-C9K-IOAk.cjs	AI (source-diff): Angular schematics bundle importing node builtins (ts, fs, path, url, os); standard migration tooling pattern.	ai	2026/05/29
source-diff	obfuscated-file:index.d.ts	AI (source-diff): TypeScript declaration file with long re-export lines; not obfuscated.	ai	2026/05/18
source-diff	net-exec-file:schematics/bundles/checker-DLkGMJj-.cjs	AI (source-diff): Schematics bundle using TS compiler APIs with fs/path/url imports; standard for Angular migration tooling.	ai	2026/05/18
source-diff	obfuscated-file:fesm2022/_effect-chunk2.mjs	AI (source-diff): Standard Angular FESM2022 bundle; readable source with license headers and class definitions.	ai	2026/04/23
source-diff	large-new-source-files	AI (source-diff): Angular core is a large framework; file count fluctuates across major versions due to chunk restructuring.	ai	2026/04/23
source-diff	obfuscated-file:types/core.d.ts	AI (source-diff): TypeScript declaration file with long re-export lines; standard for large framework type definitions.	ai	2026/04/23
source-diff	obfuscated-file:fesm2022/_debug_node-chunk.mjs	AI (source-diff): Standard Angular FESM2022 bundle with long import lines; not obfuscation. Normal for framework packages.	ai	2026/04/23
phantom-deps	phantom-dep:tslib	AI (phantom-deps): tslib is a standard TypeScript runtime helper used implicitly; well-known pattern.	ai	2026/04/23
provenance	no-provenance	AI (provenance): Older @angular/core versions predate provenance adoption; not a risk signal for this publisher.	ai	2026/04/23
bogus-package	bogus-package	AI (bogus-package): @angular/core is a canonical framework package; low-value signals are false positives for scoped Angular packages.	ai	2026/04/23
typosquat	typosquat.levenshtein:cors	AI (typosquat): @angular/core is the canonical Angular framework package with 5.3M weekly downloads; not a typosquat of 'cors'.	ai	2026/04/23

Versions (showing 26 of 26)

Version	Deps	Published
21.2.17	1 / 0	2026-06-10
21.2.16	1 / 0	2026-06-03
21.2.15	1 / 0	2026-05-28
21.2.14	1 / 0	2026-05-20
21.2.13	1 / 0	2026-05-13
21.2.12	1 / 0	2026-05-06
21.2.11	1 / 0	2026-04-29
21.2.10	1 / 0	2026-04-22
21.2.9	1 / 0	2026-04-15
21.2.8	1 / 0	2026-04-08
21.2.7	1 / 0	2026-04-01
21.2.6	1 / 0	2026-03-25
21.2.5	1 / 0	2026-03-18
21.2.4	1 / 0	2026-03-12
20.3.25	1 / 0	2026-06-10
20.3.24	1 / 0	2026-06-02
20.3.23	1 / 0	2026-05-28
20.3.22	1 / 0	2026-05-27
20.3.19	1 / 0	2026-04-15
20.3.18	1 / 0	2026-03-12
19.2.25	1 / 0	2026-06-02
19.2.24	1 / 0	2026-05-28
19.2.23	1 / 0	2026-05-27
19.2.22	1 / 0	2026-05-12
19.2.21	1 / 0	2026-04-15
19.2.20	1 / 0	2026-03-12

v21.2.17

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.16

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.15

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.14

2 findings

HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: google-wombot.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.13

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.12

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.11

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.10

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.9

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.8

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.7

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.6

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v21.2.5

4 findings

HIGH New obfuscated file: fesm2022/_debug_node-chunk.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: fesm2022/_effect-chunk2.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: types/core.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v21.2.4

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.25

2 findings

HIGH New file with network + code execution: schematics/bundles/project_tsconfig_paths-Cu6YNBK3.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.24

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.23

4 findings

HIGH New file with network + code execution: schematics/bundles/project_tsconfig_paths-D0pvNjuF.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: fesm2022/debug_node.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: fesm2022/root_effect_scheduler.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.22

4 findings

HIGH New file with network + code execution: schematics/bundles/project_tsconfig_paths-DkhzVMGt.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: fesm2022/debug_node.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

HIGH New obfuscated file: fesm2022/root_effect_scheduler.mjs source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v20.3.19

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v20.3.18

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.25

1 finding

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.2.24

2 findings

HIGH New file with network + code execution: schematics/bundles/checker-D2h8Lo1k.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.2.23

2 findings

HIGH New file with network + code execution: schematics/bundles/checker-C9K-IOAk.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.2.22

3 findings

HIGH New file with network + code execution: schematics/bundles/checker-DLkGMJj-.cjs source-diff

Newly added file contains both network calls and dynamic code execution. This is a hallmark of dropper/loader malware.

HIGH New obfuscated file: index.d.ts source-diff

Newly added source file contains lines over 3000 chars, suggesting minified or obfuscated code. New obfuscated files are a strong attack indicator.

INFO No provenance attestation provenance

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v19.2.21

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v19.2.20

2 findings

HIGH typosquat.levenshtein: Possible typosquat of 'cors' typosquat

Package name '@angular/core' is 1 edit(s) away from popular package 'cors'.

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.