Supply Chain Incidents

MAL-2025-190888

Malicious code in @posthog/pagerduty-plugin (npm)

MAL-2025-190892

Malicious code in @posthog/sendgrid-plugin (npm)

MAL-2025-190883

Malicious code in @posthog/ingestion-alert-plugin (npm)

MAL-2025-190908

Malicious code in @postman/postman-mcp-cli (npm)

MAL-2025-190911

Malicious code in @postman/secret-scanner-wasm (npm)

MAL-2025-190920

Malicious code in @zapier/stubtree (npm)

MAL-2025-190918

Malicious code in @zapier/mcp-integration (npm)

MAL-2025-190870

Malicious code in @mparpaillon/connector-parse (npm)

MAL-2025-190906

Malicious code in @postman/pm-bin-windows-x64 (npm)

MAL-2025-190900

Malicious code in @posthog/wizard (npm)

MAL-2025-190877

Malicious code in @posthog/event-sequence-timer-plugin (npm)

MAL-2025-190925

Malicious code in posthog-node (npm)

MAL-2025-190889

Malicious code in @posthog/plugin-unduplicates (npm)

MAL-2025-190901

Malicious code in @postman/final-node-keytar (npm)

MAL-2025-190869

Malicious code in @mcp-use/mcp-use (npm)

MAL-2025-190881

Malicious code in @posthog/gitub-star-sync-plugin (npm)

MAL-2025-190879

Malicious code in @posthog/geoip-plugin (npm)

MAL-2025-190871

Malicious code in @mparpaillon/imagesloaded (npm)

MAL-2025-190876

Malicious code in @posthog/databricks-plugin (npm)

MAL-2025-190902

Malicious code in @postman/mcp-ui-client (npm)

MAL-2025-190910

Malicious code in @postman/pretty-ms (npm)

MAL-2025-190927

Malicious code in web-types-lit (npm)

MAL-2025-190887

Malicious code in @posthog/nextjs-config (npm)

MAL-2025-190874

Malicious code in @posthog/currency-normalization-plugin (npm)