@flagship-io/openfeature-provider-js@1.0.0

Analysis

Package published under the name of the legitimate Flagship[.]io OpenFeature provider SDK (@flagship-io/openfeature-provider-js) but ships no functional code — only a package.json with a placeholder "test" description, no implementation, no lifecycle hooks, no repository, and no license. It is a namespace-claim/impersonation publish that reserves the legitimate vendor's package name; a later version could deliver a malicious payload to installers who believe they are installing the genuine SDK. No network IOCs present in this version.