Malicious code in sui-move-gql (npm)
The npm package sui-move-gql contained malicious code that exfiltrated Sui wallet keystores and AWS credentials from developer machines. On import, lib/diagnostics.js read sensitive files from ~/.sui/ and ~/.aws/ directories, base64-encoded them, and uploaded them to a GitHub repository via a dynamically-fetched C2 endpoint with XOR-obfuscated authentication.
- Disclosed
- Last updated
- Blast radius
- Sui ecosystem developers with active wallet keys and AWS credentials on their workstations
- Ecosystems
- Attack vectors
- Affected entities
- sui-move-gqlnpm package containing malicious code in lib/diagnostics.js
The sui-move-gql npm package was compromised with installer-side credential theft malware. Upon package import, the malicious lib/diagnostics.js module read ~/.sui/sui.keystore, ~/.sui/sui_config/ files, ~/.aws/credentials, and ~/.aws/config from the developer's home directory.
The stolen credentials were base64-encoded and exfiltrated via HTTP PUT requests to a GitHub contents API endpoint. The destination repository and authentication token were not hardcoded; instead, they were fetched at runtime from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded using a key assembled from string fragments. This design allowed the attacker to rotate the C2 endpoint and credentials without republishing the malicious package.
Execution was deliberately targeted: the malware only activated in specific Sui-ecosystem project checkouts and when git user identity matched named maintainers, and it skipped execution in CI environments. This narrowed the attack surface to real developer workstations holding live Sui wallet keys. After successful exfiltration, the module overwrote lib/diagnostics.js with an empty stub to remove forensic evidence and prevent post-incident inspection.
The incident was identified and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- sui-move-gql
- Domains
- raw.githubusercontent.com/wutang344/runtime-env-assets
Remediation
- Immediately uninstall sui-move-gql from all development machines
- Rotate all Sui wallet keys and AWS credentials that may have been exposed
- Audit git history and package.json files to identify when sui-move-gql was installed
- Review AWS CloudTrail and other logs for unauthorized access using compromised credentials
- Check for any unauthorized transactions or transfers from affected Sui wallets
- Update to a patched version of sui-move-gql once available from a verified source
- Implement package integrity verification and supply chain security scanning in CI/CD pipelines
Sources
- GitHub Advisory GHSA-34jg-764c-gvw2 · GitHub Advisory Database
Cite this entry
"Malicious code in sui-move-gql (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 19, 2026; last updated August 19, 2026. https://supplychainattack.org/incident/malicious-code-in-sui-move-gql-npm-k1rqrl
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in rust-testing-utils (npm)
The npm package rust-testing-utils contained malicious code that impersonates the pino logger and executes remotely-fetched code with arbitrary privileges. The package spawns a child process that decodes a hardcoded URL, fetches attacker-controlled content, and executes it via Function constructor with full module-loading capability.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in @syncraft-labs/core (npm)
The npm package @syncraft-labs/core contained obfuscated malicious code in its ESM build that executes on import, fetching and executing attacker-controlled payloads from Ethereum blockchain via JSON-RPC endpoints. The CommonJS build was clean, indicating targeted injection into the ESM entry point.
npmCompromised packageMalicious commit - resolvedcritical
Malicious code in localize-translate (npm)
The npm package localize-translate contained malicious code in its postinstall lifecycle script that collected host identifiers and beaconed them to an attacker-controlled endpoint (gigww0v7.instances.poc.jchunt.top) without user consent. The reconnaissance callback fired automatically on every installation, collecting hostname, platform, architecture, Node version, package name, and timestamp.
npmCompromised packageMalicious commit - containedcritical
Malicious code in mutex-plus (npm)
The npm package mutex-plus contains hidden malicious code that enables remote code execution when a callback object with a specific jobId hash is passed to runExclusive(). The payload is encrypted at rest in lib/plusMutex.min.js and decrypted using the jobId as a key, then executed as a detached Node.js process.
npmCompromised packageMalicious commit