npm package report

Is posthog-js safe?

Version 1.297.3 of posthog-js was compromised; other versions are not flagged as malicious. CyberXYZ Proxy blocks the affected versions. It also has 1 known vulnerability, the worst rated MODERATE.

Do not install posthog-js 1.297.3

CRITICAL

Compromised releases. Added to CyberXYZ 2025-11-25, OSV malicious-package feed (Google / OpenSSF).

// what we observed

The package posthog-js was found to contain malicious code. This package was compromised by the Sha1-Hulud: The Second Coming NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub. The worm will propogate itself to NPM packages the user owns and establish persistence is a GitHub action. The package may also destroy the user's home directory.

Reported by Amazon Inspector and Google Open Source Security via OSV.

// versions and what to do

Malicious: 1.297.3
Move to: 1.449.1 newest 1.x release, no known advisory
1.449.2 is newer but was published less than 4 hours ago. The CyberXYZ Proxy holds a new release for 4 hours before it installs without an alert, so it is not named here yet.

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

npm install posthog-js@1.449.1

OSV record reference reference reference

// reach

10 direct dependencies

3 carry known advisories, worst CRITICAL

1 packages depend on it

an advisory here reaches each of them

xd-post

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

cvss

5.4

medium

CVSS v3.1 base score out of 10

epss

0.43%

medium

chance of exploitation in 30 days, 38th percentile of all CVEs

xyz score

not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-8775-5hwv-wr6v, the advisory selected below

// 1 advisories

GHSA-8775-5hwv-wr6v

MODERATEGitHub ratingCVE-2023-32325

Potential for cross-site scripting in posthog-js.

Full advisory text at GitHub advisory or NVD.

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

// questions

Is posthog-js safe to install?

Version 1.297.3 of posthog-js was compromised. Other versions are not flagged as malicious.

Does posthog-js have known vulnerabilities?

Yes. CyberXYZ records 1 known vulnerability for posthog-js (npm), the worst rated MODERATE. They are GHSA-8775-5hwv-wr6v.

Which version of posthog-js should I use?

Use 1.449.1 or a later release that is not named as malicious. Versions named on this report as malicious must not be installed.

How do I check posthog-js before installing?

Search posthog-js in CyberXYZ Check at https://cyberxyz.io/check?q=posthog-js. The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.

Checked 2026-11-14 at 10:20 UTC. The most recent advisory here was published 2023-05-22. Updated continuously from NVD, GHSA, OSV and CNA feeds.