bcs-compact @1.0.1

Summary

On require('bcs-compact'), index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, and any.env* files containing SUI_/PK_B64/PRIVATE_KEY markers, base64-encodes their contents, and PUTs them to api.github.com/repos/futongwan/sui-research-notes/contents/fingerprints/... using a hardcoded GitHub personal access token. The destination host (api.github.com), repository slug (futongwan/sui-research-notes), and Bearer token are reconstructed at runtime via an XOR routine keyed on the string 'bcs-c0mpact-v10' to hide them from static inspection. After exfiltration the payload rewrites index.js on disk to remove the /* compat-probe:start */.../* compat-probe:end */ block so the installed file no longer contains the malicious code on subsequent inspection. The package is presented as a BCS codec; the exfiltration and anti-forensics behavior have no relationship to that stated purpose.

Source: amazon-inspector (85b93f1a0694dc37c94e18c12eb32ebe9cab96ded318e46ee5c774db80f4a648)