CRITICAL Maven Malware
Malicious code in org.mvnpm:posthog-node (Maven)
MAL-2025-191470
Published · Modified
Dependency scanning
Check whether org.mvnpm:posthog-node is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Description
__
Source: google-open-source-security (ea90a5928d7667bed4fa9f6effbbe6c8d3ad6521ca51ca2b01551bc02373a7d2)
This package was compromised by the Sha1-Hulud: The Second Coming NPM worm.
The malicious payload steals tokens and credentials and publishes them to
GitHub. The worm will propogate itself to NPM packages the user owns and
establish persistence is a GitHub action.
The package may also destroy the user's home directory.
Ready to move
Start Securing
Free, no credit card | First findings in minutes