Malicious code in sui-graphql-rpc (npm)

The npm package sui-graphql-rpc was found to contain malicious code in its index.js and lib/telemetry.js files. Upon require(), the package reads the installer's ~/.gitconfig file to extract the developer's email and name, then derives an AES-256-GCM decryption key using sha256(identity).\n\nThe package contains three embedded base64-encoded ciphertext blobs in a PROFILES array. The malicious code attempts to decrypt these blobs using the derived key. Any successfully decrypted blob yields JavaScript source code that is executed via new Function(code)().\n\nExecution is restricted to developer workstations and skipped in CI environments, narrowing the attack surface to a hardcoded victim allowlist. The use of victim-specific encryption keys (derived from their git identity) was an intentional evasion technique to prevent recovery of payloads by registry scanners or security researchers without access to a targeted developer's git configuration.\n\nThe package's advertised purpose as a GraphQL RPC client does not require reading ~/.gitconfig, confirming that this functionality was added solely for malicious purposes.