Malicious Code Detected in @posthog/rrweb-player Package
Summary
MAL-2025-190891: Malicious code in @posthog/rrweb-player (npm). Affects @posthog/rrweb-player versions 0.0.31. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @posthog/rrweb-player package is a JavaScript library used for replaying web sessions. It allows developers to capture and analyze user interactions on their web applications. This package is widely utilized for enhancing user experience and debugging. However, it has recently been flagged for containing malicious code, posing significant security risks to applications that rely on it.
Vulnerability Detail
The vulnerability originates from the discovery of malicious code within the @posthog/rrweb-player package, specifically in version 0.0.31. This code can potentially compromise the integrity of applications using the package, leading to unauthorized access, data breaches, or other malicious activities. The source of this vulnerability has been identified by Amazon Inspector, which has raised alarms about its implications for developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @posthog/rrweb-playerIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @posthog/rrweb-player package from your project until a secure version is released. This can be done by executing the command: 'npm uninstall @posthog/rrweb-player'. Consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @posthog/rrweb-player package has been identified as containing malicious code, which poses significant risks to applications utilizing it. Developers are advised to update or remove the package to mitigate potential threats. Tools like Vulert can assist in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for @posthog/rrweb-player →
FAQ
The malicious code can potentially allow unauthorized access to sensitive data or enable other harmful activities within applications using the package.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can alert you in real-time about any vulnerabilities, including this one.
Currently, version 0.0.31 is flagged as vulnerable. It is crucial to check for any patched versions released after this version.
If immediate updates are not feasible, consider removing the package temporarily and using alternative solutions until a secure version is available.
Utilizing tools like Vulert can help you monitor your dependencies for vulnerabilities without needing to access the code directly.
