1–10 of 11 posts
Reported to their security channel, also reported to NPM, but also wanted to raise awareness here.
Update: It seems all their NPM packages have the same problem
Update 2: https://status.posthog.com/
In `package.json`, it has a script `"preinstall": "node setup_bun.js"` + files `setup_bun.js` and `bun_environment.js` which are apparently is the malware.
It seems many of their other NPM packages also have the same problem. https://www.npmjs.com/~timgl (all published 5 hours ago)
Looking forward to the post-mortem.
1. Malware uses a "preinstall" NPM script, which is triggered upon you running `npm install`.
2. Malware installs `bun`.
3. Then it installs and starts `trufflehog` (a tool for scanning code for secrets, API keys, passwords, etc.).
We've rotated keys and passwords, unpublished all affected packages and have pushed new versions, so make sure you're on the latest version of our SDKs.
We're still figuring out how this key got compromised, and we'll follow up with a post-mortem. We'll update status.posthog.com with more updates as well.
co-founder of PostHog here. It looks like we were also a victim of this attack: https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24 We've rotated keys and passwords, unpublished all affected packages and have pushed new versions, so make sure you're on the latest version of our SDKs. We're still figuring out how this key got compromised, and we'll follow up with a post-mortem. We'll update status.posthog.com wi…