{"id":"MAL-2026-4573","summary":"Malicious code in git-userhub (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071)\nPackage name 'git-userhub' is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.json declares a postinstall hook (\"postinstall\": \"node install.js\") that runs install.js on every npm install. install.js requires child_process and performs multiple https.get calls together with hostname/identity reads — the canonical install-time fetch-and-exec shape. There is no shipped native source tree, no publisher-matching CDN, and no version-pinned binary that would justify a postinstall network fetch. Combined with the lookalike package name (git-\u003cproject\u003e typosquat shape used by recent supply-chain droppers), the structure matches a postinstall dropper that spawns child processes against fetched content on the installer's machine. Installing this package risks remote code execution and host/identity exfiltration on the installer's system or CI runner.\n","modified":"2026-05-26T06:02:34.573343542Z","published":"2026-05-21T04:36:30Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["2.1.4"],"id":"IN-MAL-2026-003738","import_time":"2026-05-26T05:51:13.27095904Z","modified_time":"2026-05-21T04:36:31Z","sha256":"1e6ae07ce4ca293e9a346b2116905dd9d7482e22a6b1088fef5aa0a1d08d65ce"},{"source":"amazon-inspector","versions":["2.1.5"],"id":"IN-MAL-2026-003741","import_time":"2026-05-26T05:51:13.654814323Z","modified_time":"2026-05-21T04:43:19Z","sha256":"7d5274a7509e9828ced100e34c8b256645ccea7e9ee51e8fe98ebaf2175f4795"},{"versions":["2.1.4"],"id":"IN-MAL-2026-003737","import_time":"2026-05-26T05:51:13.084873877Z","modified_time":"2026-05-21T04:36:30Z","sha256":"859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071","source":"amazon-inspector"},{"sha256":"c9b3a01e61eaee4ca4d20bb60dfd2d61b749e746821248b184e90ecea8348b20","source":"amazon-inspector","versions":["2.1.5"],"id":"IN-MAL-2026-003742","import_time":"2026-05-26T05:51:13.760609223Z","modified_time":"2026-05-21T04:43:20Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/git-userhub/v/2.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/git-userhub/v/2.1.4"}],"affected":[{"package":{"name":"git-userhub","ecosystem":"npm","purl":"pkg:npm/git-userhub"},"versions":["2.1.4","2.1.5"],"database_specific":{"indicators":{"package_integrity":[{"hashes":{"sha512_sri":"sha512-4epLSR45LuEw44ILlvlYtv9gqhazobuiqdUH/tErtYzITEY/BkC2Mkz7QX+VNlft7IzUVYT8MSg/yi5aiC/k0A==","sha1":"6c4722250d74a440c2f8a738f19ff0908c8618b1"},"filename":"git-userhub-2.1.5.tgz"}],"domains":["api.github.com"],"evidence_files":[{"tlsh":"5891338929f76134117364ba8b4f2001741695133a0ade5cbabc83846f92ba4c9d27ff","path":"install.js","sha256":"2286c8b21eef8ae652d8a74a357ce1ce238b899837a143e908ca103c65c19565"},{"path":"package.json","sha256":"d6fd8acaf07a26785963734071c4b3e5a509ec171d8badf1a7848368f9a4eac7","tlsh":"f4115936c5211c631bd82ed19daa219abd104c5b9d887c0833f7561c8f0e06b10b96be"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/git-userhub/MAL-2026-4573.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}