The 'sui-bcs-codec' npm package includes a hidden immediately-invoked function expression (IIFE) named 'compat-probe' in its index.js file. This code reads private key files located at ~/.sui/sui.keystore, configuration YAML files under ~/.sui/sui_config/, and environment variables in the current working directory and home directory that match specific private key markers. It compresses and base64-encodes this data, then sends it via an HTTPS PUT request to a GitHub repository (futongwan/sui-research-notes) using a Bearer token embedded in the package but obfuscated via XOR encoding. After sending the data, the package rewrites its own source file to remove the malicious code block, hindering detection. The stolen private keys control on-chain wallets, leading to immediate theft risk upon package import. The attacker's Bearer token grants write access to the receiving GitHub repository. This behavior effectively compromises any system that installs or runs this package.

Any system that installs or runs the affected versions of the 'sui-bcs-codec' package is immediately compromised through theft of private keys controlling blockchain wallets. The attacker gains access to sensitive wallet credentials and environment secrets, enabling unauthorized control of on-chain assets. Additionally, the attacker may have persistent access due to the embedded GitHub token and the package's self-modifying behavior. Full system compromise is possible, and all secrets on the affected system should be considered exposed.

There is no official patch or fix available for this malicious package. Users should immediately remove all affected versions (=1.0.0, =1.0.1, =1.0.2) of 'sui-bcs-codec' from their systems. All private keys and secrets stored on the compromised systems must be rotated immediately using a different, trusted computer. Because the package rewrites itself to remove evidence of the payload, full system compromise is likely; therefore, a thorough security assessment and potential system rebuild are recommended. Avoid installing packages from untrusted sources and verify package integrity before use.