MAL-2026-14209 Malicious code in sui-gql-rpc (npm)

On require, lib/telemetry.js runs a top-level IIFE that reads the installer's ~/.gitconfig, extracts the configured email addresses and user name, derives an AES-256-GCM key via sha256 over that identity, and attempts to decrypt three multi-kilobyte base64 ciphertext blobs stored in a PROFILES array. On successful decrypt (i.e., when the installer's git identity matches a targeted developer), the plaintext JavaScript is executed on the installer's machine via new Function(code)(). Execution is skipped when common CI environment variables are set (CI, GITHUB_ACTIONS, etc.) and when no git identity is present, and all errors are silently swallowed, ensuring the payload only fires on real developer workstations and remains inert in sandboxes. The package name misappropriates the Sui GraphQL RPC namespace to lure developers in that ecosystem. Because the executed plaintext is fully attacker-controlled JavaScript running in the installer's Node process with the installer's privileges, the effect is arbitrary remote-code execution against selected victims at import time.