git-userhub

{"modified":"2026-05-26T05:55:02Z","published":"2026-05-21T04:36:30Z","schema_version":"1.7.4","id":"MAL-2026-4573","summary":"Malicious code in git-userhub (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071)\nPackage name 'git-userhub' is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.json declares a postinstall hook (\"postinstall\": \"node install.js\") that runs install.js on every npm install. install.js requires child_process and performs multiple https.get calls together with hostname/identity reads — the canonical install-time fetch-and-exec shape. There is no shipped native source tree, no publisher-matching CDN, and no version-pinned binary that would justify a postinstall network fetch. Combined with the lookalike package name (git-<project> typosquat shape used by recent supply-chain droppers), the structure matches a postinstall dropper that spawns child processes against fetched content on the installer's machine. Installing this package risks remote code execution and host/identity exfiltration on the installer's system or CI runner.\n","affected":[{"package":{"ecosystem":"npm","name":"git-userhub"},"versions":["2.1.4","2.1.5"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["api.github.com"],"evidence_files":[{"path":"install.js","sha256":"2286c8b21eef8ae652d8a74a357ce1ce238b899837a143e908ca103c65c19565","tlsh":"5891338929f76134117364ba8b4f2001741695133a0ade5cbabc83846f92ba4c9d27ff"},{"path":"package.json","sha256":"d6fd8acaf07a26785963734071c4b3e5a509ec171d8badf1a7848368f9a4eac7","tlsh":"f4115936c5211c631bd82ed19daa219abd104c5b9d887c0833f7561c8f0e06b10b96be"}],"package_integrity":[{"filename":"git-userhub-2.1.5.tgz","hashes":{"sha1":"6c4722250d74a440c2f8a738f19ff0908c8618b1","sha512_sri":"sha512-4epLSR45LuEw44ILlvlYtv9gqhazobuiqdUH/tErtYzITEY/BkC2Mkz7QX+VNlft7IzUVYT8MSg/yi5aiC/k0A=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/git-userhub/v/2.1.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/git-userhub/v/2.1.4"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-003738","import_time":"2026-05-26T05:51:13.27095904Z","modified_time":"2026-05-21T04:36:31Z","sha256":"1e6ae07ce4ca293e9a346b2116905dd9d7482e22a6b1088fef5aa0a1d08d65ce","source":"amazon-inspector","versions":["2.1.4"]},{"id":"IN-MAL-2026-003741","import_time":"2026-05-26T05:51:13.654814323Z","modified_time":"2026-05-21T04:43:19Z","sha256":"7d5274a7509e9828ced100e34c8b256645ccea7e9ee51e8fe98ebaf2175f4795","source":"amazon-inspector","versions":["2.1.5"]},{"id":"IN-MAL-2026-003737","import_time":"2026-05-26T05:51:13.084873877Z","modified_time":"2026-05-21T04:36:30Z","sha256":"859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071","source":"amazon-inspector","versions":["2.1.4"]},{"id":"IN-MAL-2026-003742","import_time":"2026-05-26T05:51:13.760609223Z","modified_time":"2026-05-21T04:43:20Z","sha256":"c9b3a01e61eaee4ca4d20bb60dfd2d61b749e746821248b184e90ecea8348b20","source":"amazon-inspector","versions":["2.1.5"]}]}}