MAL-2026-1381

    Dashboard / Malicious Package / MAL-2026-1381

    MAL-2026-1381

    Published: 13 Mar 2026Last Modified: 23 Mar 2026

    Summary: Malicious code in @immuta/feature-flags-core (npm)

    Details: Malicious package due to data exfiltration to a hardcoded IP, command execution Source: amazon-inspector (5faa2e2b3afed77ff19adb0b231de0a6ecdd10f713507e643a56d3d5503b1e47) The package @immuta/feature-flags-core was found to contain malicious code.

    References: https://app.safedep.io/community/malysis/01KKJV06QG12NAM6641D9M9NHS

    Affected packages

    Package

    Name: @immuta/feature-flags-core

    Purl: pkg:npm/%40immuta/feature-flags-core

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions