The move-bcs-codec npm package (versions 1.0.0, 1.0.1, and 1.0.2) includes a malicious postinstall hook that runs install.js upon installation. This script reads sensitive files such as the Sui wallet keystore (~/.sui/sui.keystore), YAML config files (~/.sui/sui_config/), and environment files containing private keys. It compresses and base64 encodes these contents and uploads them to a GitHub repository using a hardcoded bearer token obfuscated via XOR with a static key. The script avoids execution in continuous integration environments by checking environment variables. After exfiltration, it removes the postinstall hook and deletes the install.js file to hide its presence. The exposure of private keys enables attackers to fully drain wallets configured on the compromised host. Removal of the package does not guarantee system cleanup due to potential further compromise.

Any system that installs move-bcs-codec versions 1.0.0, 1.0.1, or 1.0.2 is fully compromised with private keys and secrets exfiltrated to an attacker-controlled GitHub repository. This leads to complete loss of control over Sui blockchain wallets configured on the host, enabling attackers to drain all on-chain funds. The malicious code attempts to evade detection and remove traces after execution, increasing the risk of persistent compromise. Systems with this package installed should be considered fully compromised.

No official patch or fix is currently available. Immediate removal of the move-bcs-codec package versions 1.0.0, 1.0.1, and 1.0.2 is strongly recommended. All private keys and secrets stored on the affected system should be considered compromised and must be rotated immediately from a secure, unaffected environment. Due to the high likelihood of full system compromise, a full system reinstallation or forensic analysis is advised to ensure no residual malicious software remains. Monitor for any unauthorized access to blockchain wallets and revoke any exposed credentials.