MalwarePublished 6 Aug 2026

sui-graphql-client (npm) · Malicious Code

Affects sui-graphql-clientSource GCVE Database

Malicious package : remove sui-graphql-client and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:21 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13475

What to do

Remove sui-graphql-client from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsui-graphql-client	Affected =0.1.0 =0.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package sui-graphql-client versions 0.1.0 and 0.2.0 have been identified as malicious. Although static and behavioral scans did not detect typical malicious behaviors such as remote code execution or credential theft, the package is considered fully compromising any system on which it is installed. Immediate removal of the package and rotation of all secrets and keys from a separate, uncompromised system is strongly advised.

Impact

Any computer with sui-graphql-client versions 0.1.0 or 0.2.0 installed should be considered fully compromised. This implies potential unauthorized control over the system and exposure of all stored secrets and keys. Removal of the package alone may not eliminate all malicious components introduced by the package.

Defensive guidance

Remove the sui-graphql-client package versions 0.1.0 and 0.2.0 immediately. Rotate all secrets and keys stored on the affected computer from a separate, uncompromised system. Treat the affected system as fully compromised and consider rebuilding or restoring from a known good backup.

Summary

The sui-graphql-client npm package versions 0.1.0 and 0.2.0 have been flagged as malicious by the GHSA-malware source. Despite no static or dynamic detection of common malicious behaviors (e.g., exfiltration, backdoors, or installer secret access), the package is deemed to fully compromise any host where it is installed. The advisory recommends treating any affected system as fully compromised, requiring secret and key rotation from a different machine and removal of the package. There is no indication of a patch or fix, and no known exploits in the wild have been reported.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:21 UTC

Technical details

References

Community reviews