leb128x @1.0.1
Vulnerability report · Last retrieved from osv.dev August 19, 2026 at 3:49 AM UTC
OSV ID
MAL-2026-14109
Ecosystem
npm
Summary
The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires _perf.js, which on load reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, ~/.aws/credentials, ~/.aws/config, and any.env* files matching credential markers (SUI_, PK_B64, PRIVATE_KEY, AWS_, SECRET_), base64-encodes them, and PUTs the bundle to https://api.github.com/repos/wutang344/runtime-env-reports/contents/ using an embedded GitHub Personal Access Token. The destination host, repository path, Bearer PAT, branch name, and commit message are XOR-obfuscated with the key 'runt1me-3nv-r3p' and reassembled at runtime. _perf.js also calls fs.unlinkSync(__filename) to self-delete after exfiltration. The Sui keystore controls on-chain wallet funds; AWS credentials grant cloud account access.
Source: amazon-inspector (fb3862797564b06cd20320cecbdadcdd30bd5506e9afc09ed1f2ce225c22e5c8)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.