GCVE-110-OSM-2026-10488

The package embeds a self-destructing credential-theft payload in index.js, disguised as a legitimate BCS codec library. On import, the IIFE under the `compat-probe:start` comment locates `~/.sui/sui.keystore`, Sui client YAML config files, and any `.env` files containing markers `SUI_`, `PK_B64`, or `PRIVATE_KEY`, base64-encodes their contents, and exfiltrates them to an attacker-controlled GitHub repository via the GitHub Contents API using an XOR-obfuscated Bearer token. The `scrub()` function then rewrites `index.js` to erase the malicious block, providing post-execution cleanup. The payload includes explicit CI/GITHUB_ACTIONS environment checks to evade sandbox analysis. The attacker model is targeted Web3/Sui private-key theft via npm supply-chain, consistent with known Contagious Interview / crypto-theft campaigns. ENTRY index.js (main: index.js) EXFIL - Network Request in index.js: "fetch('https:" - System Information Collection in index.js: "os.platform()" ADDITIONAL FINDINGS - Platform Detection with Data Collection in index.js: "JSON.stringify({files,meta})).toS" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.js