2025 PostHog — Shai-Hulud 2.0 supply chain attack
Data compromised
Developer credentials; API keys; cloud secrets
Technical writeup
Malicious npm packages (posthog-js, posthog-node, posthog-react-native). Preinstall script used TruffleHog to scan for credentials, exfiltrate to GitHub. CI/CD compromise Nov 18; npm token stolen. 5+ hours to detection. 37+ orgs, 25K+ dev secrets. Patched by 9:30 AM UTC.
Root cause
Supply chain attack; CI/CD compromise; credential theft