The sui-gql-client npm package versions 0.1.0 and 0.2.0 contain malicious code. Installation or use of this package can lead to full compromise of the affected computer, requiring immediate secret and key rotation. Although no install-time scripts or typical supply-chain attack behaviors were detected, the package itself is considered fully malicious. Removing the package may not fully remediate the compromise due to potential persistent malicious activity.