The npm package 'sui-bcs-codec' versions 1.0.0, 1.0.1, and 1.0.2 contains malicious code that exfiltrates sensitive private key files and environment variables from the user's system. Upon requiring the package, it reads wallet keystore files and environment variables containing private keys, encodes them, and sends the data to a GitHub repository controlled by the attacker. After exfiltration, the package modifies its own source code to remove the malicious payload, making detection harder. Installation of this package results in immediate compromise of on-chain wallet keys and potentially full system compromise.