ulebkit @1.0.1

Summary

index.js unconditionally requires./_perf.js on load. _perf.js reads ~/.sui/sui.keystore, ~/.sui/sui_config/*.yaml, ~/.aws/credentials, ~/.aws/config, and scans.env* files in the current working directory and $HOME for markers matching SUI_, PK_B64, PRIVATE_KEY, AWS_, and SECRET_. The collected data is base64-encoded and PUT to api.github.com/repos/<attacker>/<repo>/contents/<random>.json using a hardcoded GitHub bearer token. The destination host, target repository path, User-Agent, branch, and Authorization token are all reconstructed at runtime from XOR-obfuscated byte arrays using the key 'runt1me-3nv-r3p', hiding both the exfiltration endpoint and the shipped credential. Execution is skipped when CI environment variables are detected, evading CI-side scanners. The package description advertises ULEB128/BCS primitives; _perf.js is unrelated to that purpose.

Source: amazon-inspector (56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9)