The npm package move-bcs-codec versions 1.0.0, 1.0.1, and 1.0.2 contains malicious code that executes a postinstall script to exfiltrate sensitive private keys and configuration files related to the Sui blockchain wallet. The script collects private keys and config files, encodes them, and uploads them to a GitHub repository using a hardcoded bearer token. It also attempts to evade detection by skipping execution in CI environments and removing evidence after execution. This compromises any system with the package installed, risking full wallet compromise and loss of on-chain funds.