Packages / posthog-js / Security

Malicious packageMAL-2025-191402Published 25 Nov 2025

Malicious code in posthog-js (npm)

Compromised versions · posthog-js

  • 1.297.3

Safe

Every other versionincluding the latest, 1.438.13

npm install posthog-js@1.438.13

  1. Not affected

    1.0.0 – 1.297.2

    918 releases

  2. Affected

    1.297.3

    1 release

  3. Safe

    1.297.4 – 1.438.13

    502 releases, latest

1421 stable releases of posthog-js, oldest to newest.

Is your project affected?

Paste your package.json, or type the range you declare for posthog-js. It is read in your browser and sent nowhere.

What happens

If one of these versions was installed

  1. Treat the machines and CI runners that installed it as compromised.
  2. Rotate the npm, GitHub and cloud tokens they could reach.
  3. Reinstall from a lockfile that pins a version outside the list.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2b422f278bf27e062b349e97360b6919e773122f21656f23d6da583ce7cb1a92)

The package posthog-js was found to contain malicious code.

Source: google-open-source-security (1199070f9140b97dfe8c2ecdfe5a68de5c3df986e7d82041c96f07ebc557f365)

This package was compromised by the Sha1-Hulud: The Second Coming NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub. The worm will propogate itself to NPM packages the user owns and establish persistence is a GitHub action. The package may also destroy the user's home directory.