The alphalend-layouts package on PyPI includes malicious functionality that harvests sensitive files such as ~/.sui/sui.keystore, Sui configuration YAML files, and environment files containing secrets marked with SUI_, PK_B64, and PRIVATE_KEY. This data is collected during installation and import via custom setup.py commands and top-level import code. The collected files are archived and exfiltrated through an HTTP PUT request to a GitHub repository controlled by the attacker. The GitHub token used for upload is stealthily reconstructed from base64-encoded fragments hidden in fake checksum fields and source constants to evade secret scanning tools. The package abuses Python PTH files to trigger exfiltration on every Python startup, making it persistently malicious. The package's advertised functionality as a BCS layouts library is a cover for this malicious behavior.

Sensitive cryptographic keys and configuration files related to the Sui blockchain environment are exfiltrated to an attacker-controlled GitHub repository. This compromises the confidentiality of private keys and secrets, potentially enabling unauthorized access or control over blockchain assets or services relying on these keys. The exfiltration occurs silently during installation and import, increasing the risk of unnoticed compromise. The abuse of PTH files causes repeated exfiltration on every Python startup, amplifying the data leak.

No official patch or remediation is currently documented. Users should immediately uninstall the alphalend-layouts package versions 4.0.0, 4.0.1, 4.0.2, and 4.1.0 and avoid installing or importing this package. Review and revoke any potentially exposed credentials, especially GitHub tokens and Sui private keys. Monitor for unauthorized access related to these secrets. Check the vendor or PyPI advisories for updates or official fixes. Consider using trusted package sources and verifying package integrity before installation.