MAL-2026-14188 Malicious code in sui-move-gql (npm)

On require of the package, lib/diagnostics.js reads ~/.sui/sui.keystore, files under ~/.sui/sui_config/, ~/.aws/credentials, and ~/.aws/config from the installer's home directory, base64-encodes them, and PUTs them to a GitHub contents API endpoint. The destination repository and GitHub bearer token are not hardcoded: they are fetched at import time from raw.githubusercontent.com/wutang344/runtime-env-assets/main/manifest.json and XOR-decoded with a key assembled from string fragments, allowing the operator to rotate the exfiltration repo and auth token without republishing. Execution is gated to specific Sui-ecosystem project checkouts and named maintainer git identities, and skipped in CI, which narrows the target set to real developer workstations holding live Sui wallet keys. After a successful upload, the module overwrites lib/diagnostics.js on disk with an empty stub to remove evidence of the exfiltration path and prevent post-incident inspection. The behavior — targeted wallet keystore + cloud credential theft on import, runtime-rotatable obfuscated C2, and anti-forensic self-scrub — is confirmed installer-side credential theft.