Malicious code in @dransay/feature-flags (npm)

Source: amazon-inspector cc545bbb96903ee25218d8cab1a7d116d2ceb1ba64a3c929c79e56a6fc8e0585 @dransay/[email protected] publishes a scoped name on the public npm registry at an inflated version 99.0.0 designed to win semver resolution against any private internal @dransay/ copy. package.json...

MAL-2026-17696 Malicious code in @dransay/feature-flags (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

Malicious code in @dransay/feature-flags (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the...

Malicious Package

Overview @dransay/feature-flags is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...