move-bcs-codec@1.0.0

Analysis

The postinstall hook (install.js) of this package steals Sui wallet keys and environment secrets and exfiltrates them to a remote GitHub repository. On install it reads ~/.sui/sui.keystore (Sui private keys), ~/.sui/sui_config/client.yaml and sui_config.yaml, and scans the current directory and home directory for .env files containing SUI_, PK_B64, or PRIVATE_KEY. All found files are base64-encoded, gzipped, and uploaded via the GitHub API (api[.]github[.]com) to the repository butongwan/sui-research-notes on the 'reports' branch under the path fingerprints/<timestamp>-<pid>.json.gz, authenticated with a hardcoded GitHub personal access token. The upload is silent (errors swallowed) and runs automatically on install.