Supply Chain Incidents

MAL-2025-190891

Malicious code in @posthog/rrweb-player (npm)

MAL-2025-190912

Malicious code in @postman/wdio-allure-reporter (npm)

MAL-2025-190928

Malicious code in zapier-platform-legacy-scripting-runner (npm)

MAL-2025-190896

Malicious code in @posthog/twitter-followers-plugin (npm)

MAL-2025-190913

Malicious code in @postman/wdio-junit-reporter (npm)

MAL-2025-190900

Malicious code in @posthog/wizard (npm)

MAL-2025-190922

Malicious code in create-mcp-use-app (npm)

MAL-2025-190920

Malicious code in @zapier/stubtree (npm)

MAL-2025-190917

Malicious code in @zapier/ai-actions-react (npm)

MAL-2025-190888

Malicious code in @posthog/pagerduty-plugin (npm)

MAL-2025-190872

Malicious code in @mparpaillon/page (npm)

MAL-2025-190886

Malicious code in @posthog/nextjs (npm)

MAL-2025-190885

Malicious code in @posthog/maxmind-plugin (npm)

MAL-2025-190883

Malicious code in @posthog/ingestion-alert-plugin (npm)

MAL-2025-190926

Malicious code in posthog-react-native (npm)

MAL-2025-190908

Malicious code in @postman/postman-mcp-cli (npm)

MAL-2025-190904

Malicious code in @postman/pm-bin-macos-arm64 (npm)

MAL-2025-190899

Malicious code in @posthog/web-dev-server (npm)

MAL-2025-190918

Malicious code in @zapier/mcp-integration (npm)

MAL-2025-190870

Malicious code in @mparpaillon/connector-parse (npm)

MAL-2025-190875

Malicious code in @posthog/customerio-plugin (npm)

MAL-2025-190911

Malicious code in @postman/secret-scanner-wasm (npm)

MAL-2025-190921

Malicious code in capacitor-voice-recorder-wav (npm)

MAL-2025-190868

Malicious code in @mcp-use/inspector (npm)