The PyPI package alphalend-layouts (versions 4.0.0, 4.0.1, 4.0.2, and 4.1.0) contains malicious code that exfiltrates sensitive installer-side secrets and private keys related to the Sui blockchain environment. This exfiltration occurs both during package installation and on import, leveraging obfuscated code to evade detection. The stolen data is archived and uploaded to an attacker-controlled GitHub repository using a reconstructed personal access token. The package's stated purpose is unrelated to these malicious activities.