MAL-2026-14188

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sui-move-gql/MAL-2026-14188.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14188
Published
2026-08-18T23:58:32Z
Modified
2026-08-19T00:30:14.629383164Z
Summary
Malicious code in sui-move-gql (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53)

On require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credentials, and ~/.aws/config from the installer's home directory, base64-encodes them, and PUTs them to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded: they are fetched at import time from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded with a key assembled from string fragments, allowing the operator to rotate the exfiltration repo and auth token without republishing. Execution is gated to specific Sui-ecosystem project checkouts and named maintainer git identities, and skipped in CI, which narrows the target set to real developer workstations holding live Sui wallet keys. After a successful upload, the module overwrites lib/diagnostics.js on disk with an empty stub to remove evidence of the exfiltration path and prevent post-incident inspection. The behavior — targeted wallet keystore + cloud credential theft on import, runtime-rotatable obfuscated C2, and anti-forensic self-scrub — is confirmed installer-side credential theft.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T00:21:12.567779804Z",
            "sha256": "e0d32aaadd6f2f9e7febdc74278d21a613be170411c50a382228f51e47447e53",
            "modified_time": "2026-08-18T23:58:32Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-018245",
            "versions": [
                "1.0.2"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sui-move-gql

Package

Name
sui-move-gql
View open source insights on deps.dev
Purl
pkg:npm/sui-move-gql

Affected ranges

Affected versions

1.*
1.0.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sui-move-gql/MAL-2026-14188.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "d90cacac8d0d9370ff7bd7d7b5491b4fbaeb8ee91307d7f0b24449f66708e1f7",
            "path": "lib/diagnostics.js",
            "tlsh": "dcd1a5da14fb313501a7b0b8ca5f9119761ad2073509ecd0b8ac9b499f8ba748273dbc"
        }
    ],
    "package_integrity": [
        {
            "filename": "sui-move-gql-1.0.2.tgz",
            "hashes": {
                "sha512_sri": "sha512-iMg3dGOTtr1s0Pd4e4KBRtXPMS1mCMpuuGTV1w0QRHXX6mLzFJwShpibaS7Y1T7oyBo8lpiKzjVS9ctgRrjc0g==",
                "sha1": "150bf19e56da7a0b10f202be173f2f1339b73129"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]