MAL-2026-14188
Dashboard / Malicious Package / MAL-2026-14188
MAL-2026-14188
Summary: Malicious code in sui-move-gql (npm)
Details: Source: amazon-inspector (e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53) On require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credentials, and ~/.aws/config from the installer's home directory, base64-encodes them, and PUTs them to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded: they are fetched at import time from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded with a key assembled from string fragments, allowing the operator to rotate the exfiltration repo and auth token without republishing. Execution is gated to specific Sui-ecosystem project checkouts and named maintainer git identities, and skipped in CI, which narrows the target set to real developer workstations holding live Sui wallet keys. After a successful upload, the module overwrites lib/diagnostics.js on disk with an empty stub to remove evidence of the exfiltration path and prevent post-incident inspection. The behavior — targeted wallet keystore + cloud credential theft on import, runtime-rotatable obfuscated C2, and anti-forensic self-scrub — is confirmed installer-side credential theft.
Affected packages
Package
Name: sui-move-gql
Purl: pkg:npm/sui-move-gql
Affected ranges
Type: N/A
Events:
