Malicious code in sui-graphql-rpc (npm)

The sui-graphql-rpc npm package (version 1.0.1) includes a malicious backdoor mechanism. Upon requiring the package, it loads telemetry.js which reads the ~/.gitconfig file of the installer to obtain the developer's email and name. These values are hashed with SHA-256 to derive an AES-256-GCM key used to decrypt three embedded base64-encoded ciphertext blobs. Successfully decrypted blobs yield JavaScript source code executed via new Function(), enabling arbitrary code execution. Execution is skipped in continuous integration environments and limited to a hardcoded victim allowlist, preventing broad detection. The use of installer-specific data as the decryption key and AES-GCM encryption prevents recovery of the payload without the targeted developer's git identity, demonstrating a sophisticated evasion technique. The malicious behavior is unrelated to the package's stated purpose as a GraphQL RPC client.

This malicious package enables targeted arbitrary code execution on developer machines of selected victims. The attack is stealthy, as it only activates for developers whose git identity matches the allowlist and does not run in CI environments, reducing detection likelihood. This can lead to compromise of developer environments, potential theft of credentials or source code, and further supply chain contamination. The malicious code execution is gated by cryptographic means tied to the victim's identity, preventing detection by generic scanning tools.

No official patch or remediation is currently documented. Users should immediately remove version 1.0.1 of sui-graphql-rpc from their projects and avoid installing this package. Verify the integrity of dependencies and audit for presence of this package. Since the malicious code targets developer environments by reading ~/.gitconfig, developers should be cautious when installing new or untrusted npm packages. Monitor for updates or advisories from the package maintainers or npm registry regarding this issue. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for current remediation guidance.