MAL-2026-4573

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/git-userhub/MAL-2026-4573.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-4573
Published
2026-05-21T04:36:30Z
Modified
2026-05-26T06:02:34.573343542Z
Summary
Malicious code in git-userhub (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071)

Package name 'git-userhub' is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.json declares a postinstall hook ("postinstall": "node install.js") that runs install.js on every npm install. install.js requires child_process and performs multiple https.get calls together with hostname/identity reads — the canonical install-time fetch-and-exec shape. There is no shipped native source tree, no publisher-matching CDN, and no version-pinned binary that would justify a postinstall network fetch. Combined with the lookalike package name (git-<project> typosquat shape used by recent supply-chain droppers), the structure matches a postinstall dropper that spawns child processes against fetched content on the installer's machine. Installing this package risks remote code execution and host/identity exfiltration on the installer's system or CI runner.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-05-21T04:36:31Z",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:51:13.27095904Z",
            "versions": [
                "2.1.4"
            ],
            "id": "IN-MAL-2026-003738",
            "sha256": "1e6ae07ce4ca293e9a346b2116905dd9d7482e22a6b1088fef5aa0a1d08d65ce"
        },
        {
            "modified_time": "2026-05-21T04:43:19Z",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:51:13.654814323Z",
            "versions": [
                "2.1.5"
            ],
            "id": "IN-MAL-2026-003741",
            "sha256": "7d5274a7509e9828ced100e34c8b256645ccea7e9ee51e8fe98ebaf2175f4795"
        },
        {
            "modified_time": "2026-05-21T04:36:30Z",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:51:13.084873877Z",
            "versions": [
                "2.1.4"
            ],
            "id": "IN-MAL-2026-003737",
            "sha256": "859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071"
        },
        {
            "modified_time": "2026-05-21T04:43:20Z",
            "source": "amazon-inspector",
            "import_time": "2026-05-26T05:51:13.760609223Z",
            "versions": [
                "2.1.5"
            ],
            "id": "IN-MAL-2026-003742",
            "sha256": "c9b3a01e61eaee4ca4d20bb60dfd2d61b749e746821248b184e90ecea8348b20"
        }
    ]
}
References
Credits

Affected packages

npm / git-userhub

Package

Name
git-userhub
View open source insights on deps.dev
Purl
pkg:npm/git-userhub

Affected ranges

Affected versions

2.*
2.1.4
2.1.5

Database specific

indicators 
{
    "package_integrity": [
        {
            "filename": "git-userhub-2.1.5.tgz",
            "hashes": {
                "sha512_sri": "sha512-4epLSR45LuEw44ILlvlYtv9gqhazobuiqdUH/tErtYzITEY/BkC2Mkz7QX+VNlft7IzUVYT8MSg/yi5aiC/k0A==",
                "sha1": "6c4722250d74a440c2f8a738f19ff0908c8618b1"
            }
        }
    ],
    "domains": [
        "api.github.com"
    ],
    "evidence_files": [
        {
            "sha256": "2286c8b21eef8ae652d8a74a357ce1ce238b899837a143e908ca103c65c19565",
            "path": "install.js",
            "tlsh": "5891338929f76134117364ba8b4f2001741695133a0ade5cbabc83846f92ba4c9d27ff"
        },
        {
            "sha256": "d6fd8acaf07a26785963734071c4b3e5a509ec171d8badf1a7848368f9a4eac7",
            "path": "package.json",
            "tlsh": "f4115936c5211c631bd82ed19daa219abd104c5b9d887c0833f7561c8f0e06b10b96be"
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/git-userhub/MAL-2026-4573.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]