
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@angular/core
Advanced tools
The @angular/core package is a fundamental part of Angular, a popular front-end web application platform. It provides the critical runtime parts of the Angular framework, including the component decorator, directives, dependency injection, and the core Angular APIs necessary for building dynamic single-page web applications.
Components
Components are the building blocks of Angular applications. They control a patch of screen called a view. The @Component decorator indicates that the class immediately below it is a component and provides metadata about the component.
"@Component({ selector: 'app-root', templateUrl: './app.component.html', styleUrls: ['./app.component.css'] }) export class AppComponent { title = 'My Angular App'; }"
Dependency Injection
Dependency Injection (DI) is a design pattern used in Angular to make components or classes dependent on interfaces rather than concrete implementations. This improves modularity and testability.
"constructor(private myService: MyService) {}"
Directives
Directives are classes that add additional behavior to elements in your Angular applications. With Angular's built-in directives, you can manage forms, lists, styles, and what users see.
"@Directive({ selector: '[appHighlight]' }) export class HighlightDirective { constructor(el: ElementRef) { el.nativeElement.style.backgroundColor = 'yellow'; } }"
React is a popular JavaScript library for building user interfaces. It focuses on a component-based architecture similar to Angular but uses a different syntax and design philosophy. React emphasizes a one-way data flow and virtual DOM for efficient rendering.
Vue.js is a progressive JavaScript framework used for building UIs and single-page applications. It is designed from the ground up to be incrementally adoptable. Vue also focuses on the ViewModel part of the MVVM pattern and employs a reactive and composable data model.
The sources for this package are in the main Angular repo. Please file issues and pull requests against that repo.
Usage information and reference details can be found in Angular documentation.
License: MIT
20.1.4 (2025-07-31)
| Commit | Type | Description | | -- | -- | -- | | db3c5826ee | fix | exclude more safe reads expression from 2way-binding (#62852) |
| Commit | Type | Description | | -- | -- | -- | | c633b63e56 | fix | update symbols for new signals api (#62284) |
| Commit | Type | Description | | -- | -- | -- | | ab6033979a | fix | add missing http options allowed in fetch API (#62881) | | 15670d8417 | fix | propagate plain errors when parsing fails (#62765) |
<!-- CHANGELOG SPLIT MARKER --><a name="20.2.0-next.2"></a>
FAQs
Angular - the core framework
The npm package @angular/core receives a total of 3,825,880 weekly downloads. As such, @angular/core popularity was classified as popular.
We found that @angular/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.