registry / sui-migration-audit-cli / 1.0.0

sui-migration-audit-cli@1.0.0

Audit Sui TypeScript SDKs for legacy JSON-RPC leftovers, GraphQL type-rendering mismatches, and Pyth push/Lazer oracle path drift.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Explicit execution fetches unverified, environment-overridable code and executes it via require. This provides remote code execution in the invoking user's context.

Static reason

No blocking static signals were detected.

Trigger

User runs sui-migration-audit.

Impact

Arbitrary code from the remote rules archive, redirect target, or RULES_URL override can execute and access the invoking user's files.

Mechanism

downloaded rule-module caching and dynamic require

Attack narrative

On first invocation, the CLI downloads a tarball from RULES_URL, extracts it with tar, caches package/index.js, requires it as code, then calls its optional postScan hook. RULES_URL can be overridden and accepts file://, so an attacker controlling the environment, redirect, or rules artifact can cause arbitrary code execution.

Rationale

The package implements an unverified staged payload path culminating in dynamic code execution, not merely data-driven audit rules. Lack of an install hook limits activation to explicit CLI use but does not remove the concrete RCE surface.

Evidence

package.jsonbin/sui-migration-audit.js~/.cache/sui-migration-audit/rules.js$TMPDIR/sma-*/rules.tgz

Network endpoints1

registry.npmjs.org/sui-migration-audit-rules/-/sui-migration-audit-rules-1.0.0.tgz

OSV Corroboration

Package sui-migration-audit-cli@1.0.0 contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper, silent-relay, or backdoor mechanisms were observed in the shipped contents. ## Source: ghsa-malware (a39d909f174c471a336567b47e00e83495206e11a238dc22456c74dbdceebf6a) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

sui-migration-audit-cli@1.0.0

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code