Not malware. Analytics package with session recording features. Suspicious behaviors are likely due to legitimate functionality.
No verification record available.
The package posthog-js is a site analytics package, which inherently involves collecting user data and session recording. The presence of base64 encoding, dynamic script injection, and potential data exfiltration are concerning but can be explained by the legitimate use case of session recording and plugin injection for customization. YARA rule matches of type base64_shell_base64 on source map files are ignored. While the LLM-based analysis highlights potential vulnerabilities like data redaction bypass and cross-origin image loading issues, these are not strong indicators of malicious intent, but rather potential security flaws in the implementation of legitimate functionality. Therefore, based on the provided evidence, it is not possible to definitively classify this package as malware.
