MAL-2026-4573 Malicious code in git-userhub (npm)
Malicious package
Published
MAL-2026-4573 is a malicious package: git-userhub (npm). Every version was published to cause harm.
Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.
Reference: https://insights.sbomify.com/MAL-2026-4573/ (Markdown: https://insights.sbomify.com/MAL-2026-4573/index.md)
- Package
- git-userhub
- Registry
- npm
What is MAL-2026-4573?
MAL-2026-4573 is a malicious package in git-userhub, published on 21 May 2026.
Official description
Package name 'git-userhub' is a lookalike of a GitHub-related identity, with no legitimate publisher backing. The package.json declares a postinstall hook ("postinstall": "node install.js") that runs install.js on every npm install. install.js requires child_process and performs multiple https.get calls together with hostname/identity reads — the canonical install-time fetch-and-exec shape. There is no shipped native source tree, no publisher-matching CDN, and no version-pinned binary that would justify a postinstall network fetch. Combined with the lookalike package name (git-<project> typosquat shape used by recent supply-chain droppers), the structure matches a postinstall dropper that spawns child processes against fetched content on the installer's machine. Installing this package risks remote code execution and host/identity exfiltration on the installer's system or CI runner.
What should I do about MAL-2026-4573?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.