sui-bcs-codec @1.0.2

Summary

On require('sui-bcs-codec'), a hidden IIFE labeled 'compat-probe' in index.js reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, and.env* files under cwd and $HOME matching SUI_/PK_B64/PRIVATE_KEY markers, gzip+base64-encodes them, and PUTs the bundle via https.request to api.github.com. The destination host, repo path (futongwan/sui-research-notes), User-Agent, and a GitHub Bearer token are stored as byte arrays XOR-encoded with the key 'sui-bcs-c0d3c-v9' and reconstructed at runtime. After the upload runs, index.js rewrites itself via fs.writeFileSync(__filename,...) to remove the payload block. Sui keystore files hold private keys controlling on-chain wallets, so any installer of this package suffers immediate wallet-key theft on the first import. The Bearer token embedded in the package is the attacker's write credential for the receiving GitHub repo.

Source: amazon-inspector (11a215fced265f75473130d499c7d6ea6097f63aa19c595fc5445a56633b1c6e)