VYPR
← All malware advisories

npm · Malicious package advisory

Malware

feature-flag-service

MAL-2026-3253

Malicious code in feature-flag-service (npm)

Details


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (9ba3fb4537827a604de645ffad07771bc9f7ed4e1f4a70b16b4c35effadcf744)
The package feature-flag-service was found to contain malicious code.

## Source: ossf-package-analysis (69173384cc716a5a94e29e7abd367e903fcb600836a9c0a5f5c656236b2fd803)
The OpenSSF Package Analysis project identified 'feature-flag-service' @ 2.0.3 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (2)

  • 2.0.3
  • 2.0.2

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.