Supply Chain Incidents

MAL-2025-190874

Malicious code in @posthog/currency-normalization-plugin (npm)

MAL-2025-190884

Malicious code in @posthog/kinesis-plugin (npm)

MAL-2025-190915

Malicious code in @seung-ju/react-native-action-sheet (npm)

MAL-2025-190893

Malicious code in @posthog/snowflake-export-plugin (npm)

MAL-2025-190873

Malicious code in @posthog/automatic-cohorts-plugin (npm)

MAL-2025-190895

Malicious code in @posthog/twilio-plugin (npm)

MAL-2025-190924

Malicious code in posthog-docusaurus (npm)

MAL-2025-190912

Malicious code in @postman/wdio-allure-reporter (npm)

MAL-2025-190890

Malicious code in @posthog/react-rrweb-player (npm)

MAL-2025-190880

Malicious code in @posthog/github-release-tracking-plugin (npm)

MAL-2025-190897

Malicious code in @posthog/url-normalizer-plugin (npm)

MAL-2025-190909

Malicious code in @postman/postman-mcp-server (npm)

MAL-2025-190898

Malicious code in @posthog/variance-plugin (npm)

MAL-2025-190891

Malicious code in @posthog/rrweb-player (npm)

MAL-2025-190866

Malicious code in @ensdomains/buffer (npm)

MAL-2025-190896

Malicious code in @posthog/twitter-followers-plugin (npm)

MAL-2025-190867

Malicious code in @mcp-use/cli (npm)

MAL-2025-190928

Malicious code in zapier-platform-legacy-scripting-runner (npm)

MAL-2025-190922

Malicious code in create-mcp-use-app (npm)

MAL-2025-190919

Malicious code in @zapier/spectral-api-ruleset (npm)

MAL-2025-190917

Malicious code in @zapier/ai-actions-react (npm)

MAL-2025-190872

Malicious code in @mparpaillon/page (npm)

MAL-2025-190885

Malicious code in @posthog/maxmind-plugin (npm)

MAL-2025-190886

Malicious code in @posthog/nextjs (npm)