posthog-js

1.438.13 · 20 Oct 2026(Apache-2.0 AND MIT)10.1M / weekRepository Homepage npm Atom feed

Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

Paste your package.json, or type the range you declare for posthog-js. It is read in your browser and sent nowhere.

Line	Newest	Where it stands
	1.438.13	Safe from 1.57.2

Your version

Moderate
Potential for cross-site scripting in PostHog-jsGHSA-8775-5hwv-wr6v · 22 May 2023
- 1.x1.0.0 – 1.57.1Fixed in 1.57.2
Malicious
Malicious code in posthog-js (npm)MAL-2025-191402 · 25 Nov 2025
Named versions only: 1.297.3. 1.438.13 is safe.

What npm and deps.dev say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 21 Oct 2026. Releases and advisories last read 21 Oct 2026.