The bcs-mini npm package (version 1.0.1) masquerades as a BCS codec but includes a self-invoking payload in index.js that, upon loading, reads wallet keystore files (~/.sui/sui.keystore), configuration files (~/.sui/sui_config/), and environment variables containing private keys. It base64-encodes these contents and uploads them via the GitHub API to a hardcoded repository controlled by the attacker. The GitHub credentials and repository details are XOR-obfuscated and reconstructed at runtime using the key 'bcs-c0mpact-v10'. After exfiltration, the malicious code region is removed from index.js on disk to evade detection. A check prevents execution in CI environments to reduce discovery during automated builds. The embedded GitHub Bearer token authenticates the upload, enabling stealthy data theft. This behavior effectively compromises any system running this package.

Systems with bcs-mini version 1.0.1 installed are fully compromised due to the theft of private wallet keys and secrets. Attackers gain access to sensitive cryptographic material, potentially allowing unauthorized transactions or identity theft related to the Sui wallet. The malware's self-modifying behavior and CI environment evasion increase the difficulty of detection and remediation. Removal of the package alone does not guarantee system integrity, as attackers may have established persistent access or installed additional malware.

No official patch or fix is available for bcs-mini version 1.0.1. Immediate removal of the package is recommended. All private keys and secrets stored on the compromised system must be rotated from a separate, trusted device. Due to the high likelihood of full system compromise, consider a full system audit and reinstallation from known good sources. Monitor for any unauthorized access or suspicious activity related to the stolen credentials. Avoid using this package or any untrusted npm packages that could contain malicious payloads.