Malicious code in sui-move-gql (npm)

The sui-move-gql package version 1.0.2 includes a malicious module (lib/diagnostics.js) that reads sensitive credential files (~/.sui/sui.keystore, ~/.sui/sui_config/, ~/.aws/credentials, ~/.aws/config) from the installer's home directory. It base64-encodes these files and sends them via a PUT request to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded but are fetched at runtime from a remote manifest and XOR-decoded with a dynamically assembled key, enabling the attacker to rotate the exfiltration targets without republishing the package. Execution is restricted to specific Sui ecosystem project checkouts and maintainer git identities, and it skips execution in CI environments, focusing on real developer workstations. After successful data exfiltration, the malicious code overwrites itself with an empty stub to erase evidence and prevent post-incident inspection. This behavior constitutes targeted credential theft from developer environments.

This malicious package compromises developer workstations by stealing sensitive wallet keystore files and cloud credentials, potentially allowing attackers to access Sui wallets and AWS resources. The dynamic and obfuscated exfiltration mechanism complicates detection and response. The self-deleting payload hinders forensic investigation, increasing the risk of prolonged undetected compromise and unauthorized access to critical assets.

No official patch or remediation is currently documented for this malicious package version. Users should immediately remove sui-move-gql version 1.0.2 from their environments and audit any systems where it was installed for signs of credential theft. Rotate any exposed credentials, including Sui wallet keys and AWS credentials. Avoid using this package version and monitor for updates or advisories from the package maintainers or security vendors. Since this is a malicious package, rely on trusted sources and package registries to verify package integrity before installation.