EUVD-2025-199360

Malicious code in posthog-js npm...

Embedded Malicious Code

Overview posthog-js is a Posthog-js allows you to automatically capture usage and send events to PostHog. Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was remov...

PT-2023-23731 · Unknown · Posthog-Js

Name of the Vulnerable Software and Affected Versions: PostHog-js versions prior to 1.57.2 Description: The issue concerns a potential for cross-site scripting in the PostHog-js library. Users are advised to upgrade to version 1.57.2 to resolve the issue. For users unable to upgrade, having a...