Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-65gu-85sy-p7er
Summary
@posthog/drop-events-on-property-plugin contains malware after npm account takeover
On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentials from popular online services. It is recommended all credentials be rotated, npm cache is cleared, .node_modules directory is removed and all dependencies be rolled back to previous versions.
Aliases
0
alias GMS-2025-731
Fixed_packages
Affected_packages
0
url pkg:npm/%40posthog/drop-events-on-property-plugin@0.0.8
purl pkg:npm/%40posthog/drop-events-on-property-plugin@0.0.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-65gu-85sy-p7er
resource_url http://public2.vulnerablecode.io/packages/pkg:npm/%2540posthog/drop-events-on-property-plugin@0.0.8
References
0
reference_url https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
reference_id
reference_type
scores
url https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
1
reference_url https://socket.dev/blog/shai-hulud-strikes-again-v2
reference_id
reference_type
scores
url https://socket.dev/blog/shai-hulud-strikes-again-v2
2
reference_url https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
reference_id
reference_type
scores
url https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
Weaknesses
0
cwe_id 506
name Embedded Malicious Code
description The product contains code that appears to be malicious in nature.
Exploits
Severity_range_scorenull
Exploitability0.5
Weighted_severity0.0
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-65gu-85sy-p7er