The sui-graphql-client npm package versions 0.1.0 and 0.2.0 have been flagged as malicious by the GHSA-malware source. Despite no static or dynamic detection of common malicious behaviors (e.g., exfiltration, backdoors, or installer secret access), the package is deemed to fully compromise any host where it is installed. The advisory recommends treating any affected system as fully compromised, requiring secret and key rotation from a different machine and removal of the package. There is no indication of a patch or fix, and no known exploits in the wild have been reported.

Any computer with sui-graphql-client versions 0.1.0 or 0.2.0 installed should be considered fully compromised. This implies potential unauthorized control over the system and exposure of all stored secrets and keys. Removal of the package alone may not eliminate all malicious components introduced by the package.

Remove the sui-graphql-client package versions 0.1.0 and 0.2.0 immediately. Rotate all secrets and keys stored on the affected computer from a separate, uncompromised system. Treat the affected system as fully compromised and consider rebuilding or restoring from a known good backup. No official patch or fix is available; remediation relies on removal and secret rotation.