Malicious code in sui-migration-audit-rules (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1) The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies ~/.sui/sui.keystore (Sui wallet signing keys controlling on-chain funds), walks the current working directory, home directory, and additional paths (work, ops, alphafi) for.env* files matching /PK_B64|PRIVATE_KEY|SUI_/, packages the collected files together with os.hostname() and os.userInfo() metadata into a gzip tar, and POSTs the archive over plain HTTP to the hardcoded bare-IP endpoint http://91.92.241.99:8080/collect (variable named TELEMETRY with a COLLECT_URL env override). Comments describe the routine as opt-out telemetry for scan summaries, but the payload is wallet keystore material and environment secrets, not scan metadata. The destination is not associated with any documented Sui or Mysten Labs infrastructure. ## Source: ghsa-malware (463bbc5e417bf04a6676179a7de62ade021d8bf7167d6b603ee02cf5e30d1ace) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
AI Analysis
Technical Summary
The sui-migration-audit-rules npm package (version 1.0.0) includes a malicious postScan function in index.js that copies the ~/.sui/sui.keystore file containing Sui wallet signing keys. It also searches the current working directory, home directory, and additional specified paths for environment files containing private keys or secrets matching certain patterns. These files, along with system hostname and user information, are compressed into a gzip tar archive and sent via HTTP POST to a hardcoded IP address (http://91.92.241.99:8080/collect). The code comments misleadingly describe this as opt-out telemetry for scan summaries, but the actual payload is sensitive credential material. The destination server is not affiliated with any known Sui or Mysten Labs infrastructure, indicating malicious intent.
Potential Impact
Exfiltration of Sui wallet signing keys and environment secrets can lead to unauthorized access and control over on-chain funds and other sensitive resources. The compromise of private keys and secrets poses a critical security risk to users relying on this package, potentially resulting in theft of assets or further compromise of systems where these credentials are used.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using sui-migration-audit-rules version 1.0.0. Inspect systems for potential compromise of wallet keys and environment secrets. Rotate any exposed credentials and wallet keys. Monitor for unauthorized transactions or access. Since the package exfiltrates data over plain HTTP to an untrusted endpoint, network-level blocking of traffic to the IP address 91.92.241.99 may help mitigate ongoing data leakage. Check vendor advisories or trusted security sources for updates on remediation.
Malicious code in sui-migration-audit-rules (npm)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1) The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies ~/.sui/sui.keystore (Sui wallet signing keys controlling on-chain funds), walks the current working directory, home directory, and additional paths (work, ops, alphafi) for.env* files matching /PK_B64|PRIVATE_KEY|SUI_/, packages the collected files together with os.hostname() and os.userInfo() metadata into a gzip tar, and POSTs the archive over plain HTTP to the hardcoded bare-IP endpoint http://91.92.241.99:8080/collect (variable named TELEMETRY with a COLLECT_URL env override). Comments describe the routine as opt-out telemetry for scan summaries, but the payload is wallet keystore material and environment secrets, not scan metadata. The destination is not associated with any documented Sui or Mysten Labs infrastructure. ## Source: ghsa-malware (463bbc5e417bf04a6676179a7de62ade021d8bf7167d6b603ee02cf5e30d1ace) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The sui-migration-audit-rules npm package (version 1.0.0) includes a malicious postScan function in index.js that copies the ~/.sui/sui.keystore file containing Sui wallet signing keys. It also searches the current working directory, home directory, and additional specified paths for environment files containing private keys or secrets matching certain patterns. These files, along with system hostname and user information, are compressed into a gzip tar archive and sent via HTTP POST to a hardcoded IP address (http://91.92.241.99:8080/collect). The code comments misleadingly describe this as opt-out telemetry for scan summaries, but the actual payload is sensitive credential material. The destination server is not affiliated with any known Sui or Mysten Labs infrastructure, indicating malicious intent.
Potential Impact
Exfiltration of Sui wallet signing keys and environment secrets can lead to unauthorized access and control over on-chain funds and other sensitive resources. The compromise of private keys and secrets poses a critical security risk to users relying on this package, potentially resulting in theft of assets or further compromise of systems where these credentials are used.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately remove and avoid using sui-migration-audit-rules version 1.0.0. Inspect systems for potential compromise of wallet keys and environment secrets. Rotate any exposed credentials and wallet keys. Monitor for unauthorized transactions or access. Since the package exfiltrates data over plain HTTP to an untrusted endpoint, network-level blocking of traffic to the IP address 91.92.241.99 may help mitigate ongoing data leakage. Check vendor advisories or trusted security sources for updates on remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-12472
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a735747bf8831d53915a082
Added to database: 08/05/2026, 15:31:19 UTC
Last enriched: 08/05/2026, 17:35:26 UTC
Last updated: 09/07/2026, 22:33:27 UTC
Views: 18
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.