@angular/core

About

Angular - the core framework

What detecting @angular/core tells you about a site

@angular/core is the heart of an Angular application — a full, opinionated framework rather than a library, so its presence tells you the site ships a complete Angular toolchain: dependency injection, RxJS-driven data flow, the Angular router and a CLI-managed build. Angular apps look and behave differently from React/Vue SPAs, and the bundle structure reflects that.

Why the exact @angular/core version matters

Angular ships a major version roughly every six months with a documented support window, so the exact version directly tells you the support status. Modern Angular (15+) introduced standalone components and signals (16+), a major shift away from NgModules. Reading the bundled @angular/core version tells you whether you're looking at a current signals-based app or a legacy NgModule codebase well past its support window.

@angular/core in a real-world stack

When you find @angular/core in a bundle, it rarely travels alone. rxjs (always), zone.js, and the rest of the @angular/* scoped packages (common, router, forms) at the same version.

Quick facts

This package powers Angular

The @angular/core package is the canonical implementation of Angular. Sourcemap Explorer uses this exact npm package as the framework-level fingerprint when it flags Angular on a page — both via the bundled node_modules/@angular/core/ source paths and via the embedded package.json inside the JavaScript sourcemap.

Common pairings

Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.

What @angular/core pulls in

@angular/core declares 1 direct dependency — each one also rides into any bundle that ships @angular/core, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .

How Sourcemap Explorer detects @angular/core

@angular/core ships as v22.1.0, published 2026-07-29 and carries 1 direct dependency, 3 peer dependencies (rxjs, zone.js, @angular/compiler), 1,088 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when @angular/core rides inside a deployed bundle — here is how the detection works.

We catch @angular/core from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/@angular/core/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `@angular/core` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/@angular/core/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/@angular/core/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/@angular/core/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Major releases of @angular/core

When each major version first landed. Major bumps are where breaking changes live, so this timeline is the fastest way to date the @angular/core version a site actually ships against the ecosystem.

Recent security advisories for @angular/core

The 5 most recent advisories affecting some versions of @angular/core, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. HIGHCVE-2026-69151· 2026-08-03

   Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

2. MODERATECVE-2026-50557· 2026-06-15

   Angular: Template and Attribute Namespace Sanitization Bypass (XSS)

3. MODERATECVE-2026-52725· 2026-06-15

   @angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)

4. HIGHCVE-2026-54267· 2026-06-15

   Angular Client Hydration DOM Clobbering & Response-Cache Poisoning

5. HIGHCVE-2026-32635· 2026-03-13

   Angular vulnerable to XSS in i18n attribute bindings

Recent versions

@angular/core README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

npm install -g @angular/cli

ng new [PROJECT NAME]

cd [PROJECT NAME]
ng serve

FAQ