The @kuperka/chainguard-sdk npm package versions 1.0.1 and 1.0.2 include a payload that, when executed, harvests a wide range of sensitive data from the browser environment, including cookies, storage data, form inputs, CSRF/auth tokens, and Web3 wallet identifiers. It encodes this data and exfiltrates it via GET and POST requests to a hardcoded webhook URL. The code also scans the entire HTML document for credential-like strings such as Stripe live keys, AWS access keys, GitHub personal access tokens, JWTs, and OpenAI keys, including these in the exfiltrated data. A keylogger captures keystrokes from input fields along with contextual information and sends this data periodically to the same endpoint. Furthermore, the code monkey-patches the fetch API to capture outbound request details, including URLs, methods, authorization headers, and partial request bodies, forwarding these to the attacker. To hide its malicious behavior, it overlays a full-screen branded interface simulating a security tool with a fake risk score. The package name and branding are designed to impersonate a legitimate security product, increasing the likelihood of user trust and installation.

This malicious package compromises user privacy and security by stealing a broad range of sensitive information, including authentication tokens, credentials, Web3 wallet identifiers, and keystrokes. The exfiltration of such data can lead to account takeover, financial theft, unauthorized access to cloud services, and further compromise of user systems or applications relying on these credentials. The stealthy overlay conceals the data theft from users, increasing the risk of prolonged undetected compromise.

No official patch or remediation is currently documented for this malicious package. Users and organizations should immediately remove @kuperka/chainguard-sdk versions 1.0.1 and 1.0.2 from their projects and dependency trees. Avoid installing or updating to these versions. Conduct audits of environments where this package was used to identify potential data exposure and rotate any potentially compromised credentials, tokens, and keys. Monitor for suspicious activity related to affected accounts and services. Use trusted sources and verify package authenticity before installation.