News for hackers. Stuff that matters.

A comment on SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM. Parent comment

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by oakesm9 on Monday November 24, 2025 @12:40PM (#46036747)
Your status page isn't clear, but are all versions between the compromised and "safe to install" versions compromised or just the ones listed?

For example I installed `posthog-react-native` version `4.12.4` which is between the `4.11.1` version which is compromised and the safe to install version `4.13.0`. Is that version compromised or not?

[ Parent | on HN ]
Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by timgl on Monday November 24, 2025 @12:49PM (#46036855)
The only compromised versions are the ones listed. Any other versions are fine.
[ Parent | on HN ]
Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by oakesm9 on Monday November 24, 2025 @12:51PM (#46036879)
Thank you for the confirmation. I have updated to 4.13.0 anyway.
[ Parent | on HN ]