move-bcs-codec (npm) · Malicious Code
Affects move-bcs-codecSource GCVE Database
Malicious package : remove move-bcs-codec and rotate any secrets on hosts that installed it.
Data as of 7 Aug 2026, 07:44 UTC
Malicious package
Published to npm · OSV MAL-2026-13450
What to do
Remove move-bcs-codec from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmmove-bcs-codec | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package move-bcs-codec versions 1.0.0, 1.0.1, and 1.0.2 contains malicious code that executes a postinstall script to exfiltrate sensitive private keys and configuration files related to the Sui blockchain wallet. The script collects private keys and config files, encodes them, and uploads them to a GitHub repository using a hardcoded bearer token. It also attempts to evade detection by skipping execution in CI environments and removing evidence after execution. This compromises any system with the package installed, risking full wallet compromise and loss of on-chain funds.