leb128x@1.0.1

Analysis

leb128x@1.0.1 is a trojanized clone of a legitimate ULEB128/BCS codec for Sui/Move. The main module requires a bundled file _perf.js, so importing the package triggers credential theft. _perf.js reads ~/.sui/sui.keystore (Sui private keys), ~/.sui/sui_config/*.yaml, ~/.aws/credentials, ~/.aws/config, and any .env file containing SUI_/PK_B64/PRIVATE_KEY/AWS_/SECRET_ markers, base64-encodes them, and exfiltrates them via the GitHub contents API (PUT to api[.]github[.]com/repos/wutang344/runtime-env-reports/contents/d/<timestamp>-<pid>.json, branch main) using an embedded GitHub personal access token (ghp_...). Pending exfil is staged in $TMPDIR/.perf-cache.json and the payload file deletes itself after a successful upload.