registry / Remote code execution / sui-migration-audit-cli

sui-migration-audit-cli

Audit Sui TypeScript SDKs for legacy JSON-RPC leftovers, GraphQL type-rendering mismatches, and Pyth push/Lazer oracle path drift.

This report shows the evidence for sui-migration-audit-cli@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 3mo ago · by lpm-firewall-ai

The package implements an unverified staged payload path culminating in dynamic code execution, not merely data-driven audit rules. Lack of an install hook limits activation to explicit CLI use but does not remove the concrete RCE surface.

Static reason

No blocking static signals were detected.

Trigger

User runs sui-migration-audit.

Impact

Arbitrary code from the remote rules archive, redirect target, or RULES_URL override can execute and access the invoking user's files.

Mechanism

downloaded rule-module caching and dynamic require

Attack narrative

On first invocation, the CLI downloads a tarball from RULES_URL, extracts it with tar, caches package/index.js, requires it as code, then calls its optional postScan hook. RULES_URL can be overridden and accepts file://, so an attacker controlling the environment, redirect, or rules artifact can cause arbitrary code execution.

AI rationale

Evidence

package.jsonbin/sui-migration-audit.js~/.cache/sui-migration-audit/rules.js$TMPDIR/sma-*/rules.tgz

Network endpoints1

registry.npmjs.org/sui-migration-audit-rules/-/sui-migration-audit-rules-1.0.0.tgz

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

bin/sui-migration-audit.js downloads a remote tarball on first CLI run.
RULES_URL is environment-overridable, including file:// paths.
Downloaded package/index.js is copied to ~/.cache/sui-migration-audit/rules.js and required.
The loaded module's postScan function is invoked against the user-selected scan root.

Evidence against

package.json has no npm lifecycle scripts.
Network and execution occur only after explicit CLI invocation.
Embedded rules provide an offline fallback.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.42 KB of source, external domains: registry.npmjs.org

Source & flagged code

3 flagged

bin/sui-migration-audit.jsView file

7const os = require("os"); L8: const { execSync } = require("child_process"); L9:

High

Child Process

Package source references child process execution.

bin/sui-migration-audit.jsView on unpkg · L7

7const os = require("os"); L8: const { execSync } = require("child_process"); L9: L10: const RULES_URL = process.env.RULES_URL || "https://registry.npmjs.org/sui-migration-audit-rules/-/sui-migration-audit-rules-1.0.0.tgz"; L11: const CACHE = path.join(os.homedir(), ".cache", "sui-migration-audit");

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sui-migration-audit.jsView on unpkg · L7

4// refreshes them on first run and falls back to the embedded set offline. L5: const fs = require("fs"); L6: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sui-migration-audit.jsView on unpkg · L4

Source & flagged code

3 flagged · loading source

bin/sui-migration-audit.jsView file

7const os = require("os"); L8: const { execSync } = require("child_process"); L9:

High

Child Process

Package source references child process execution.

bin/sui-migration-audit.jsView on unpkg · L7

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/sui-migration-audit.jsView on unpkg · L7

4// refreshes them on first run and falls back to the embedded set offline. L5: const fs = require("fs"); L6: const path = require("path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sui-migration-audit.jsView on unpkg · L4

Findings

2 High3 Medium2 Low

HighChild Processbin/sui-migration-audit.js

HighSame File Env Network Executionbin/sui-migration-audit.js

MediumDynamic Requirebin/sui-migration-audit.js

MediumNetwork

MediumEnvironment Vars

LowFilesystem

LowUrl Strings

Affected versions and remediation

This report applies to sui-migration-audit-cli@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing sui-migration-audit-cli@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-07 12:35:23.810Z (UTC).

Source advisory published: 2026-08-06 18:06:12.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 6, 2026, 6:05 PM 1.0.0shownMaliciousRemote Code ExecutionBlockPublishedAug 1, 2026, 4:06 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages