MalwarePublished 6 Aug 2026

sui-migration-audit-cli (npm) · Malicious Code

Affects sui-migration-audit-cliSource GCVE Database

Malicious package : remove sui-migration-audit-cli and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 15:41 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13476

What to do

Remove sui-migration-audit-cli from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsui-migration-audit-cli	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package sui-migration-audit-cli version 1.0.0 is identified as malicious. Although no install-time hooks or direct credential exfiltration mechanisms were observed in the scanned files, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, trusted system is strongly advised. There is no guarantee that removing the package will eliminate all malicious software introduced by its installation.

Impact

Any system with sui-migration-audit-cli@1.0.0 installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. The compromise may extend beyond the package itself, potentially leaving persistent malicious software even after package removal.

Defensive guidance

Remove the sui-migration-audit-cli@1.0.0 package immediately. Rotate all secrets and keys stored on the compromised system from a separate, trusted computer. Because full system compromise is possible, consider a full system rebuild or forensic analysis to ensure removal of all malicious artifacts. Monitor for any suspicious activity post-remediation.

Summary

The npm package sui-migration-audit-cli@1.0.0 has been flagged as malicious by multiple sources including Amazon Inspector and GHSA malware advisories. Despite the absence of install-time lifecycle hooks, credential access, network exfiltration, droppers, silent-relay, or backdoor mechanisms in the scanned files, the package is considered to fully compromise any system where it is installed. The advisory recommends treating any computer with this package as fully compromised, necessitating immediate secret and key rotation from a separate machine and removal of the package. Due to potential persistent malicious software beyond the package itself, removal alone may not restore system integrity.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 15:41 UTC

Technical details

References

Community reviews