MAL-2026-14209

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sui-gql-rpc/MAL-2026-14209.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-14209
Published
2026-08-19T02:55:50Z
Modified
2026-08-19T03:00:12.763661996Z
Summary
Malicious code in sui-gql-rpc (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33)

On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email addresses and user name, derives an AES-256-GCM key via sha256 over that identity, and attempts to decrypt three multi-kilobyte base64 ciphertext blobs stored in a PROFILES array. On successful decrypt (i.e., when the installer's git identity matches a targeted developer), the plaintext JavaScript is executed on the installer's machine via new Function(code)(). Execution is skipped when common CI environment variables are set (CI, GITHUB_ACTIONS, etc.) and when no git identity is present, and all errors are silently swallowed, ensuring the payload only fires on real developer workstations and remains inert in sandboxes. The package name misappropriates the Sui GraphQL RPC namespace to lure developers in that ecosystem. Because the executed plaintext is fully attacker-controlled JavaScript running in the installer's Node process with the installer's privileges, the effect is arbitrary remote-code execution against selected victims at import time.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-08-19T02:57:23.69284786Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-19T02:55:50Z",
            "sha256": "12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33",
            "id": "IN-MAL-2026-018315",
            "versions": [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / sui-gql-rpc

Package

Name
sui-gql-rpc
View open source insights on deps.dev
Purl
pkg:npm/sui-gql-rpc

Affected ranges

Affected versions

1.*
1.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sui-gql-rpc/MAL-2026-14209.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "3417d7e688fb496567bc119cb16d21cf4ba414573a5e332a74778a7e11160c63",
            "path": "lib/telemetry.js",
            "tlsh": "d342ae9b1efaf07001a439e6f2972494615889e33028ddd1fb5d662c4fca92081fd6ef"
        }
    ],
    "package_integrity": [
        {
            "filename": "sui-gql-rpc-1.0.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-X0/ROqYcpbVAGUzFkCckIol/QSyLEuM3ptPia3gcOTnIjLX4F47vxbfKp6LNzowz9/FnUwj4RT4IUN2MN91+eA==",
                "sha1": "751098b08da39844c8da78f9596d5a232740e764"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]