Malicious code in sui-gql-rpc (npm)
The npm package sui-gql-rpc contained malicious code that executed arbitrary JavaScript on developer machines at import time. The package used typosquatting to impersonate the legitimate Sui GraphQL RPC namespace and targeted specific developers by deriving encryption keys from their git identity.
- Disclosed
- Last updated
- Blast radius
- Developers in the Sui ecosystem who installed the malicious package during the compromise window.
- Ecosystems
- Attack vectors
- Affected entities
- sui-gql-rpcMalicious npm package impersonating Sui GraphQL RPC namespace
The npm package sui-gql-rpc was found to contain malicious code in lib/telemetry.js that executed on require. The malicious code ran a top-level IIFE that read the installer's ~/.gitconfig to extract email addresses and username, then derived an AES-256-GCM decryption key via SHA256 hashing of that identity.
The package contained three multi-kilobyte base64-encoded ciphertext blobs in a PROFILES array. When the installer's git identity matched a targeted developer, the code would decrypt and execute the plaintext JavaScript via new Function(code)() with full Node process privileges, achieving arbitrary remote code execution.
The attack was designed to evade detection by skipping execution when common CI environment variables (CI, GITHUB_ACTIONS, etc.) were set and when no git identity was present. All errors were silently swallowed to remain inert in sandboxes while firing on real developer workstations.
The package name deliberately misappropriated the Sui GraphQL RPC namespace to lure developers in that ecosystem. The incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- sui-gql-rpc
Remediation
- Immediately uninstall sui-gql-rpc from all systems
- Audit npm install logs to identify when the package was installed
- Review git configuration and any suspicious activity on affected developer machines during the compromise window
- Rotate any credentials or secrets that may have been exposed on affected systems
- Check for any unauthorized changes or artifacts left by the malicious code execution
- Use npm audit to scan for other malicious packages
- Consider implementing package signature verification and allowlisting for critical dependencies
Sources
- GitHub Advisory GHSA-4c65-5fr5-9xq3 · GitHub Advisory Database
Cite this entry
"Malicious code in sui-gql-rpc (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-sui-gql-rpc-npm-9iklz6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in create-coin (npm)
create-coin@20.1.1 on npm contained malicious postinstall code that collected sensitive environment variables, credentials, and host reconnaissance data. The package impersonated an esbuild platform build and exfiltrated data to a hardcoded endpoint.
npmCompromised packageTyposquatting - containedcritical
Malicious code in chai-as-testkit (npm)
The npm package chai-as-testkit is a typosquat/impersonation attack delivering obfuscated malicious code that executes on import. The package falsely claims to be a vulnerability management tool but ships pino library files under a different author, with a synthetic stub that loads a 4MB+ obfuscated bundle containing attacker-controlled code.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in @next-fonts/font (npm)
@next-fonts/font is a typosquat package on npm that executes arbitrary attacker-controlled code via a blockchain-mediated C2 channel when its Inter() function is called. The malicious payload is base64-encoded and executed through Node.js spawn or eval, with no legitimate font functionality.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in chai-as-soul (npm)
chai-as-soul@2.3.5 is a typosquat of the pino logging library containing malicious code that exfiltrates environment variables (including AWS/GCP/CI tokens) and executes arbitrary remote code on installation.
npmTyposquattingCompromised package