Reported to their security channel, also reported to NPM, but also wanted to raise awareness here.
Update: It seems all their NPM packages have the same problem
Update 2: https://status.posthog.com/
Reported to their security channel, also reported to NPM, but also wanted to raise awareness here.
Update: It seems all their NPM packages have the same problem
Update 2: https://status.posthog.com/
It seems many of their other NPM packages also have the same problem. https://www.npmjs.com/~timgl (all published 5 hours ago)
Looking forward to the post-mortem.
1. Malware uses a "preinstall" NPM script, which is triggered upon you running `npm install`.
2. Malware installs `bun`.
3. Then it installs and starts `trufflehog` (a tool for scanning code for secrets, API keys, passwords, etc.).
You've reached the end!
roskoalexey•1h ago
In `package.json`, it has a script `"preinstall": "node setup_bun.js"` + files `setup_bun.js` and `bun_environment.js` which are apparently is the malware.