SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by timgl on Monday November 24, 2025 @12:01PM (#46036239)

co-founder here. We mentioned it in the main thread about this: https://news.ycombinator.com/item?id=46032650 and on status.posthog.com

- posthog-node 4.18.1, 5.13.3 and 5.11.3

- posthog-js 1.297.3

- posthog-react-native 4.11.1

- posthog-docusaurus 2.0.6

If you make sure you're on the latest version you should be good.

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by smallerfish on Monday November 24, 2025 @12:03PM (#46036260)

Thanks. Also - maybe change "talk to a human" to "talk to a grumpy robot" :)

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by timgl on Monday November 24, 2025 @12:39PM (#46036733)

Hm did you click on "help" (on the right side) -> "Email our support engineer" when logged in?

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by smallerfish on Monday November 24, 2025 @01:45PM (#46037532)

Ahhh, TBH I didn't look on the right. I dug through the menu on the left, thinking the right hand bar (which has the rotated labels) was all getting-started/docs related things. In my defense I have a fairly wide monitor and tend to full-screen the browser.

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by oakesm9 on Monday November 24, 2025 @12:40PM (#46036747)

Your status page isn't clear, but are all versions between the compromised and "safe to install" versions compromised or just the ones listed?

For example I installed `posthog-react-native` version `4.12.4` which is between the `4.11.1` version which is compromised and the safe to install version `4.13.0`. Is that version compromised or not?

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by timgl on Monday November 24, 2025 @12:49PM (#46036855)

The only compromised versions are the ones listed. Any other versions are fine.

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by oakesm9 on Monday November 24, 2025 @12:51PM (#46036879)

Thank you for the confirmation. I have updated to 4.13.0 anyway.

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by hinkley on Monday November 24, 2025 @01:25PM (#46037254)

This is now the main thread. Though dang likes to merge dupes.

[ Parent | on HN ]