npm package report

Is @posthog/plugin-server safe?

This package is in our known-malicious corpus. Details below.

Flagged as malicious

credential_stealer, affects all versions

cvss

7.1

how bad it is if exploited, out of 10

epss

0.50%

chance of exploitation in the next 30 days

xyz score

3.3

CyberXYZ composite, out of 10

fig. 01 — GHSA-v64v-fq96-c5wv, the advisory selected below

// advisories

GHSA-v64v-fq96-c5wv

HIGHCVE-2025-1520

PostHog ClickHouse Table Functions SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PostHog. Authentication is required to exploit this vulnerability.

Affected: <= 1.10.7
Fixed in: not stated
Weakness: CWE-89
Published: 2025-04-23
Source: github

GHSA NVD MITRE reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-09-22 at 04:20 UTC. The most recent advisory here was published 2025-04-23. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is @posthog/plugin-server safe? npm package security report | CyberXYZ