Malicious code in @kuperka/chainguard-sdk (npm)

The npm package @kuperka/chainguard-sdk was published with embedded malicious code designed to steal sensitive information from users' browsers. The package advertised itself as a Web3 ChainGuard SDK but contained a malicious app.js file that initialized a credential harvesting mechanism.\n\nThe malicious code collected multiple categories of sensitive data: document cookies, localStorage and sessionStorage contents, all input field values, and credentials matching specific patterns (Stripe sk_live_, AWS AKIA, GitHub ghp_, JWT tokens, and OpenAI sk- keys). It also captured EVM wallet addresses from window.ethereum.selectedAddress and Solana wallet addresses from window.solana.publicKey.\n\nAdditionally, the code implemented keystroke logging on INPUT, TEXTAREA, and SELECT elements, batching keystrokes every 50 characters, every 5 seconds, or on newline—capturing passwords and seed phrases. The fetch API was monkey-patched to intercept outbound requests, capturing URLs, methods, request bodies (up to 2000 bytes), and Authorization headers.\n\nAll collected data was base64-encoded and exfiltrated to a hardcoded third-party webhook at https://webhook.site/b9155136-5f6d-4084-b19e-33c694a44616 via both Image src beacons and fetch POST requests. The incident was identified and credited to the OpenSSF malicious-packages project.