The npm package @kuperka/chainguard-sdk versions 1.0.1 and 1.0.2 contains malicious code that exfiltrates sensitive user data. Upon loading, it collects cookies, localStorage/sessionStorage data, form inputs, CSRF/auth tokens, and Web3 wallet identifiers, encoding and sending them to a hardcoded external endpoint. It also scans the page content for credential patterns such as Stripe keys, AWS keys, GitHub tokens, JWTs, and OpenAI keys. Additionally, it captures keystrokes with context and intercepts fetch requests to steal authorization headers and request bodies. The malicious code then displays a fake security overlay to conceal its activity. The package impersonates a legitimate security tool by using the 'chainguard' name and branding.