Malware in sui-move-graphql
Malware was discovered in the npm package sui-move-graphql. Systems with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different computer.
- Disclosed
- Last updated
- Blast radius
- Any system with the package installed or running
- Ecosystems
- Attack vectors
- Affected entities
- sui-move-graphql
The npm package sui-move-graphql was found to contain malware. According to the GitHub Advisory (GHSA-xgmm-vq93-f5vx), any computer that has this package installed or running should be considered fully compromised.\n\nThe advisory recommends that all secrets and keys stored on affected computers be rotated immediately from a different, uncompromised system. While the package should be removed, the advisory notes that full control of the computer may have been given to an outside entity, meaning there is no guarantee that removing the package alone will remove all malicious software resulting from the installation.\n\nThis is a critical supply chain incident affecting the npm ecosystem.
Indicators of compromise
- Packages
- sui-move-graphql
Remediation
- Immediately rotate all secrets and keys from a different, uncompromised computer
- Remove the sui-move-graphql package from all affected systems
- Conduct a full security audit of any system that had this package installed
- Monitor affected systems for signs of unauthorized access or persistence mechanisms
- Consider the affected system(s) as potentially fully compromised and plan for complete rebuild if critical systems are involved
Sources
- GitHub Advisory GHSA-xgmm-vq93-f5vx · GitHub Advisory Database
Cite this entry
"Malware in sui-move-graphql." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 18, 2026; last updated August 18, 2026. https://supplychainattack.org/incident/malware-in-sui-move-graphql-s9v49e
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in fund-portfolio (npm)
The npm package fund-portfolio version 999.9.12 was identified as malicious by the OpenSSF Package Analysis project. The malicious version communicates with a domain associated with malicious activity.
npmCompromised package - containedcritical
Malicious code in @syncraft-labs/react (npm)
The npm package @syncraft-labs/react contained obfuscated malicious code in its ESM distribution that implements the EtherHiding pattern, fetching and executing arbitrary code from an Ethereum smart contract via RPC endpoints. The tampering occurred post-build in the dist/index.js artifact.
npmCompromised package - containedcritical
Malicious code in 8-fetchsight-web (npm)
The npm package 8-fetchsight-web contained malicious code that fetches and executes arbitrary JavaScript from a mutable Bitbucket repository with no integrity checks. The package uses a top-level IIFE to load remote HTML content and re-execute all scripts, allowing the attacker to inject arbitrary code into any page loading the package.
npmCompromised package - resolvedcritical
Malicious code in 2-loadsight-web (npm)
The npm package 2-loadsight-web contained malicious code that fetches and executes arbitrary JavaScript from an unpinned, mutable Bitbucket URL. The package wraps HTML content fetched from https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight and injects it as live script tags into the consuming page, allowing the attacker to execute code in the host document's origin.
npmCompromised package