Malicious Code Detected in @posthog/sendgrid-plugin: Security Alert
Summary
MAL-2025-190892: Malicious code in @posthog/sendgrid-plugin (npm). Affects @posthog/sendgrid-plugin versions 0.0.8. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @posthog/sendgrid-plugin is a package designed for integrating SendGrid email services with PostHog analytics. It allows users to send emails through SendGrid while tracking user interactions and engagement metrics. However, this package has been identified to contain malicious code, posing significant security risks to applications utilizing it.
Vulnerability Detail
The vulnerability originates from a malicious code injection within the @posthog/sendgrid-plugin package, specifically version 0.0.8. This malicious code can potentially compromise the integrity of applications that depend on this package, leading to unauthorized access, data breaches, or other malicious activities. The issue was identified by Amazon Inspector, which flagged the package for containing harmful code.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @posthog/sendgrid-pluginIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not feasible, consider removing the @posthog/sendgrid-plugin package from your project until a secure version is released. You can do this by executing: npm uninstall @posthog/sendgrid-plugin. Alternatively, monitor your application for any unusual activities that may arise from using this package.
Conclusion
The @posthog/sendgrid-plugin has been flagged for containing malicious code, which poses a significant risk to applications using it. Users are advised to update or remove the package to mitigate potential security threats. Regular monitoring and using tools like Vulert can help maintain application security.
See every vulnerability recorded for @posthog/sendgrid-plugin →
FAQ
It is a package that integrates SendGrid email services with PostHog analytics, allowing users to send and track emails.
The malicious code can compromise application security, potentially leading to unauthorized access or data breaches.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
As of now, a patched version has not been specified. It is crucial to monitor the package repository for updates.
Consider removing the package from your project and monitoring for any unusual activities until a secure version is available.
