Malicious code in ckeditor5-ckbox (npm)

The unscoped npm package 'ckeditor5-ckbox' impersonates the legitimate '@ckeditor/ckeditor5-ckbox' plugin by name. It includes a preinstall hook in its package.json that runs 'node index.js' during installation. This script gathers machine identifiers such as hostname, user info (username, uid, gid, shell), platform, architecture, home directory, current working directory, and executes 'whoami' and 'id' commands. The collected data is sent via HTTP POST to a hardcoded Burp Collaborator OAST domain. The package contains no legitimate CKEditor functionality and serves solely as an install-time beacon for data exfiltration.

Installation of this malicious package results in unauthorized collection and exfiltration of sensitive system information from the installer's environment. This can lead to privacy violations and potential reconnaissance for further attacks. No direct code execution beyond the preinstall script is indicated, and no legitimate functionality is provided by the package.

Users should avoid installing the unscoped 'ckeditor5-ckbox' package and instead use the official scoped package '@ckeditor/ckeditor5-ckbox'. Since no patch or fix exists for this malicious package, the best mitigation is to verify package names carefully before installation and rely on trusted package sources. There is no vendor advisory or official fix for this malicious package. Monitoring for installation of similarly named typosquat packages is recommended.