sui-move-gql

{"modified":"2026-08-18T23:58:32Z","published":"2026-08-18T23:58:32Z","schema_version":"1.7.4","id":"MAL-2026-14188","summary":"Malicious code in sui-move-gql (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53)\nOn require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credentials, and ~/.aws/config from the installer's home directory, base64-encodes them, and PUTs them to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded: they are fetched at import time from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded with a key assembled from string fragments, allowing the operator to rotate the exfiltration repo and auth token without republishing. Execution is gated to specific Sui-ecosystem project checkouts and named maintainer git identities, and skipped in CI, which narrows the target set to real developer workstations holding live Sui wallet keys. After a successful upload, the module overwrites lib/diagnostics.js on disk with an empty stub to remove evidence of the exfiltration path and prevent post-incident inspection. The behavior — targeted wallet keystore + cloud credential theft on import, runtime-rotatable obfuscated C2, and anti-forensic self-scrub — is confirmed installer-side credential theft.\n","affected":[{"package":{"ecosystem":"npm","name":"sui-move-gql"},"versions":["1.0.2"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/diagnostics.js","sha256":"d90cacac8d0d9370ff7bd7d7b5491b4fbaeb8ee91307d7f0b24449f66708e1f7","tlsh":"dcd1a5da14fb313501a7b0b8ca5f9119761ad2073509ecd0b8ac9b499f8ba748273dbc"}],"package_integrity":[{"filename":"sui-move-gql-1.0.2.tgz","hashes":{"sha1":"150bf19e56da7a0b10f202be173f2f1339b73129","sha512_sri":"sha512-iMg3dGOTtr1s0Pd4e4KBRtXPMS1mCMpuuGTV1w0QRHXX6mLzFJwShpibaS7Y1T7oyBo8lpiKzjVS9ctgRrjc0g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sui-move-gql/v/1.0.2"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018245","import_time":"2026-08-19T00:21:12.567779804Z","modified_time":"2026-08-18T23:58:32Z","sha256":"e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53","source":"amazon-inspector","versions":["1.0.2"]}]}}