MalwarePublished 13 Jul 2026Updated 5 Aug 2026

cktool-core (npm) · Malicious Code

Affects cktool-coreSource GCVE Database

Malicious package : remove cktool-core and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10457

What to do

Remove cktool-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcktool-core	Affected 1.0.0 – 1.0.4 5 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The cktool-core package on npm is a malicious package impersonating Apple's private @apple/cktool.core package. When installed due to resolver misrouting, it executes a postinstall script that generates a unique identifier and sends it, along with version and timestamp data, to an attacker-controlled external server. This behavior occurs unconditionally during installation, resulting in execution of attacker-controlled JavaScript and data exfiltration. The package is labeled as a proof-of-concept for dependency confusion but functions identically to a real attack targeting Apple's private namespace.

Impact

Installation of the malicious cktool-core package results in execution of attacker-controlled code on the installer's machine during the postinstall phase. It also causes exfiltration of a unique installer identifier, version, and timestamp to an external attacker-controlled server. This can lead to unauthorized data disclosure and potential further compromise depending on the attacker's payload. The attack exploits dependency confusion, where a private scoped package is resolved incorrectly to a public malicious package.

Defensive guidance

Users should verify that their package resolvers correctly resolve scoped packages to the intended private registries to avoid fetching this malicious public package. Avoid installing cktool-core versions 1.0.0, 1.0.1, and 1.0.2 from the public npm registry. Monitor vendor advisories for updates or official fixes. Since this is not a cloud service, remediation depends on user-side resolver configuration and package source verification.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:57 UTC

Technical details

References

Community reviews