@posthog/rrweb
MAL-2025-190673
npmmalware11/24/2025
Description
Malicious code in @posthog/rrweb (npm)
Indicators of Compromise
SHA256 Hashes (4)
8278c73c0fa29817d8923864303d2e24c5a7bd038a9f8a2cae587329a3837cab
8e7ff62f7afccd552b5eff3833fa122ace1a2f8ef6447e4b372673896063098f
47b86bf336cedf6f91a8d7625488637e2b6c794bc6dd87380390f3723bcbfe93
a4d5c9fb8bfa73d4225eaa381816d0360bd0be5d566c631f24138c7b75d68528
References (4)
https://github.com/advisories/GHSA-c37j-qh72-54w3OSVhttps://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomainsOSVhttps://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attackOSVhttps://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromisedOSV
Details
Ecosystemnpm
Attack Typemalware
Published11/24/2025
Aliases
GHSA-c37j-qh72-54w3
Quick Actions