Malicious code in sui-gql-rpc (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33) On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email addresses and user name, derives an AES-256-GCM key via sha256 over that identity, and attempts to decrypt three multi-kilobyte base64 ciphertext blobs stored in a PROFILES array. On successful decrypt (i.e., when the installer's git identity matches a targeted developer), the plaintext JavaScript is executed on the installer's machine via new Function(code)(). Execution is skipped when common CI environment variables are set (CI, GITHUB_ACTIONS, etc.) and when no git identity is present, and all errors are silently swallowed, ensuring the payload only fires on real developer workstations and remains inert in sandboxes. The package name misappropriates the Sui GraphQL RPC namespace to lure developers in that ecosystem. Because the executed plaintext is fully attacker-controlled JavaScript running in the installer's Node process with the installer's privileges, the effect is arbitrary remote-code execution against selected victims at import time.
Malicious code in sui-gql-rpc (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33) On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email addresses and user name, derives an AES-256-GCM key via sha256 over that identity, and attempts to decrypt three multi-kilobyte base64 ciphertext blobs stored in a PROFILES array. On successful decrypt (i.e., when the installer's git identity matches a targeted developer), the plaintext JavaScript is executed on the installer's machine via new Function(code)(). Execution is skipped when common CI environment variables are set (CI, GITHUB_ACTIONS, etc.) and when no git identity is present, and all errors are silently swallowed, ensuring the payload only fires on real developer workstations and remains inert in sandboxes. The package name misappropriates the Sui GraphQL RPC namespace to lure developers in that ecosystem. Because the executed plaintext is fully attacker-controlled JavaScript running in the installer's Node process with the installer's privileges, the effect is arbitrary remote-code execution against selected victims at import time.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14209
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a85b4c7acd9273b49252849
Added to database: 08/19/2026, 13:51:03 UTC
Last updated: 08/19/2026, 13:51:35 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.