Malicious Code Detected in launch-darkly-js Package - Version 199.99.105
Summary
MAL-2026-1050: Malicious code in launch-darkly-js (npm). Affects launch-darkly-js versions 199.99.105. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The launch-darkly-js package is a JavaScript client for LaunchDarkly, a feature management platform that allows developers to control feature releases and conduct A/B testing. This package is widely used in applications to manage feature flags and improve user experience. However, version 199.99.105 has been flagged for containing malicious code that communicates with a domain associated with harmful activities.
Vulnerability Detail
The vulnerability in the launch-darkly-js package arises from its version 199.99.105, which has been identified as malicious by the OpenSSF Package Analysis project. The package's code is designed to communicate with a domain linked to malicious activities, potentially compromising the security of applications that utilize it. This could lead to unauthorized access, data breaches, or other security incidents.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall launch-darkly-jsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the launch-darkly-js package from your project until a secure version is released. You can do this by running: npm uninstall launch-darkly-js.
Conclusion
The launch-darkly-js package version 199.99.105 has been identified as malicious, posing significant security risks to applications that utilize it. It is crucial to update to a secure version or remove the package to protect your application from potential threats.
See every vulnerability recorded for launch-darkly-js →
FAQ
The package communicates with a domain known for malicious activities, which can lead to security risks for applications using it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
Consider removing the launch-darkly-js package from your project until a secure version is available to mitigate risks.
You can visit the official npm page for launch-darkly-js or its GitHub repository for documentation and updates.
Using the affected version can lead to unauthorized access, data breaches, and other security incidents, compromising the integrity of your application.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
