aftermath-sui

Details

**Severity:** Critical

**Affected versions:** `> 0`

The aftermath-sui package was published to the npm registry by user 'jet0010001' (maintainer email [email protected]) as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK (Aftermath Finance is a DeFi protocol on the Sui blockchain). The package was published at version 99.0.0 - an inflated version number characteristic of dependency-confusion attacks, intended to cause a misconfigured resolver to prefer this public lookalike over the intended private/internal dependency of the same name.

The package declares a preinstall hook ("node setup.js || true") that executes automatically at npm install time, before any application code runs. The bundled setup.js performs host reconnaissance and credential harvesting: it collects the machine hostname, the current OS username, the current working directory, the contents of /etc/hostname, and the output of 'git remote -v', and it enumerates process environment variables whose names match the pattern /key|secret|token|pass|auth|private|drone|gitea|sui|admin|deploy/i - capturing API keys, secrets, tokens, passwords, and Sui/deploy/CI credentials. The collected data is serialized to JSON and exfiltrated via an HTTPS POST to the hardcoded attacker-controlled endpoint https://2.25.140.71:8443/aftermath/npm-dep-conf, with TLS certificate verification disabled (rejectUnauthorized: false) so a self-signed listener is accepted. Errors are silently swallowed so the install appears to succeed. The published module code (index.js) is a benign stub exporting only { version: "99.0.0" }, consistent with a package built solely to deliver the install-time beacon.

The install-time payload is byte-for-byte identical across the campaign's packages (aftermath-finance, aftermath-sui, aftermathfi), all published by the same maintainer within seconds of each other and all beaconing to the same collector.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e75093cc63dc66da4 […]

**References:**
- https://github.com/ossf/malicious-packages/blob/e75093cc63dc66da4ed75fb437177a7e21195ca5/osv/malicious/npm/aftermath-sui/MAL-2026-10942.json
- https://www.npmjs.com/package/aftermath-sui
- https://github.com/ossf/malicious-packages/blob/0c11afc7acc22b6ae6dcd1d9e05bf37368cc773e/osv/malicious/npm/aftermath-sui/MAL-2026-10942.json
- https://www.npmjs.com/package/aftermath-sui/v/99.0.0
- https://github.com/advisories/GHSA-qchw-j4p5-4j78

Compromised versions (1)

• > 0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.