{"id":"MAL-2026-14188","summary":"Malicious code in sui-move-gql (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53)\nOn require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credentials, and ~/.aws/config from the installer's home directory, base64-encodes them, and PUTs them to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded: they are fetched at import time from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded with a key assembled from string fragments, allowing the operator to rotate the exfiltration repo and auth token without republishing. Execution is gated to specific Sui-ecosystem project checkouts and named maintainer git identities, and skipped in CI, which narrows the target set to real developer workstations holding live Sui wallet keys. After a successful upload, the module overwrites lib/diagnostics.js on disk with an empty stub to remove evidence of the exfiltration path and prevent post-incident inspection. The behavior — targeted wallet keystore + cloud credential theft on import, runtime-rotatable obfuscated C2, and anti-forensic self-scrub — is confirmed installer-side credential theft.\n","modified":"2026-08-19T00:30:14.629383164Z","published":"2026-08-18T23:58:32Z","database_specific":{"malicious-packages-origins":[{"sha256":"e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53","source":"amazon-inspector","versions":["1.0.2"],"id":"IN-MAL-2026-018245","import_time":"2026-08-19T00:21:12.567779804Z","modified_time":"2026-08-18T23:58:32Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sui-move-gql/v/1.0.2"}],"affected":[{"package":{"name":"sui-move-gql","ecosystem":"npm","purl":"pkg:npm/sui-move-gql"},"versions":["1.0.2"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"sha256":"d90cacac8d0d9370ff7bd7d7b5491b4fbaeb8ee91307d7f0b24449f66708e1f7","tlsh":"dcd1a5da14fb313501a7b0b8ca5f9119761ad2073509ecd0b8ac9b499f8ba748273dbc","path":"lib/diagnostics.js"}],"package_integrity":[{"filename":"sui-move-gql-1.0.2.tgz","hashes":{"sha1":"150bf19e56da7a0b10f202be173f2f1339b73129","sha512_sri":"sha512-iMg3dGOTtr1s0Pd4e4KBRtXPMS1mCMpuuGTV1w0QRHXX6mLzFJwShpibaS7Y1T7oyBo8lpiKzjVS9ctgRrjc0g=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sui-move-gql/MAL-2026-14188.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}