OpenSSF/OSV advisory MAL-2026-3253 confirms this npm version as malicious. The package feature-flag-service was found to contain malicious code.
Source
OpenSSF Malicious Packages via OSV
Summary
Malicious code in feature-flag-service (npm)
Details
The package feature-flag-service was found to contain malicious code.
## Source: ossf-package-analysis (69173384cc716a5a94e29e7abd367e903fcb600836a9c0a5f5c656236b2fd803) The OpenSSF Package Analysis project identified 'feature-flag-service' @ 2.0.3 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
Decision reason
OpenSSF Malicious Packages via OSV confirms feature-flag-service@2.0.3 as malicious (MAL-2026-3253): Malicious code in feature-flag-service (npm)