{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          },
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "domains": [
            "api.github.com"
          ],
          "evidence_files": [
            {
              "path": "install.js",
              "sha256": "2286c8b21eef8ae652d8a74a357ce1ce238b899837a143e908ca103c65c19565",
              "tlsh": "5891338929f76134117364ba8b4f2001741695133a0ade5cbabc83846f92ba4c9d27ff"
            },
            {
              "path": "package.json",
              "sha256": "d6fd8acaf07a26785963734071c4b3e5a509ec171d8badf1a7848368f9a4eac7",
              "tlsh": "f4115936c5211c631bd82ed19daa219abd104c5b9d887c0833f7561c8f0e06b10b96be"
            }
          ],
          "package_integrity": [
            {
              "filename": "git-userhub-2.1.5.tgz",
              "hashes": {
                "sha1": "6c4722250d74a440c2f8a738f19ff0908c8618b1",
                "sha512_sri": "sha512-4epLSR45LuEw44ILlvlYtv9gqhazobuiqdUH/tErtYzITEY/BkC2Mkz7QX+VNlft7IzUVYT8MSg/yi5aiC/k0A=="
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "npm",
        "name": "git-userhub"
      },
      "versions": [
        "2.1.4",
        "2.1.5"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "actran@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "IN-MAL-2026-003738",
        "import_time": "2026-05-26T05:51:13.27095904Z",
        "modified_time": "2026-05-21T04:36:31Z",
        "sha256": "1e6ae07ce4ca293e9a346b2116905dd9d7482e22a6b1088fef5aa0a1d08d65ce",
        "source": "amazon-inspector",
        "versions": [
          "2.1.4"
        ]
      },
      {
        "id": "IN-MAL-2026-003741",
        "import_time": "2026-05-26T05:51:13.654814323Z",
        "modified_time": "2026-05-21T04:43:19Z",
        "sha256": "7d5274a7509e9828ced100e34c8b256645ccea7e9ee51e8fe98ebaf2175f4795",
        "source": "amazon-inspector",
        "versions": [
          "2.1.5"
        ]
      },
      {
        "id": "IN-MAL-2026-003737",
        "import_time": "2026-05-26T05:51:13.084873877Z",
        "modified_time": "2026-05-21T04:36:30Z",
        "sha256": "859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071",
        "source": "amazon-inspector",
        "versions": [
          "2.1.4"
        ]
      },
      {
        "id": "IN-MAL-2026-003742",
        "import_time": "2026-05-26T05:51:13.760609223Z",
        "modified_time": "2026-05-21T04:43:20Z",
        "sha256": "c9b3a01e61eaee4ca4d20bb60dfd2d61b749e746821248b184e90ecea8348b20",
        "source": "amazon-inspector",
        "versions": [
          "2.1.5"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (859f77ac10aa89722823e0477f8f6986db2b54dd25b1b2aedb05ee31d5891071)\nPackage name \u0027git-userhub\u0027 is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.json declares a postinstall hook (\"postinstall\": \"node install.js\") that runs install.js on every npm install. install.js requires child_process and performs multiple https.get calls together with hostname/identity reads \u2014 the canonical install-time fetch-and-exec shape. There is no shipped native source tree, no publisher-matching CDN, and no version-pinned binary that would justify a postinstall network fetch. Combined with the lookalike package name (git-\u003cproject\u003e typosquat shape used by recent supply-chain droppers), the structure matches a postinstall dropper that spawns child processes against fetched content on the installer\u0027s machine. Installing this package risks remote code execution and host/identity exfiltration on the installer\u0027s system or CI runner.\n",
  "id": "MAL-2026-4573",
  "modified": "2026-05-26T05:55:02Z",
  "published": "2026-05-21T04:36:30Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/git-userhub/v/2.1.5"
    },
    {
      "type": "PACKAGE",
      "url": "https://www.npmjs.com/package/git-userhub/v/2.1.4"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in git-userhub (npm)"
}