move-bcs-codec @1.0.2

Summary

move-bcs-codec@1.0.2 declares a postinstall hook (package.json line 7: "postinstall": "node install.js") that runs install.js on npm install. install.js reads ~/.sui/sui.keystore, YAML files under ~/.sui/sui_config/, and.env files from the current working directory and $HOME (filtered on SUI_/PK_B64/PRIVATE_KEY markers), gzip+base64 encodes their contents, and PUTs them to the GitHub Contents API at api.github.com/repos/futongwan/sui-research-notes using a hardcoded bearer token. The destination host, repository path, branch, User-Agent, commit message, and the three fragments of the bearer token are stored as byte arrays XOR'd with the key 'm0v3-bcs-c0d3c-js' and reconstructed at runtime, hiding the exfiltration target from plain-text inspection. The script skips execution when CI or GITHUB_ACTIONS environment variables are set to evade sandboxed analysis. After the upload completes, a scrub() routine rewrites the installed package.json to remove scripts.postinstall and unlinks install.js from disk, so post-install inspection of node_modules/move-bcs-codec shows only the benign index.js library. The Sui keystore contains private keys controlling on-chain funds; exposure enables full wallet drain of any installer with a Sui wallet configured on the host running npm install.

Source: amazon-inspector (c00077e83bd841dae96e61d432da796cf21839a32e5caf03e7256b2573225335)