cktool-core is a malicious npm package that mimics Apple's private scoped package @apple/cktool.core. Due to resolver misrouting, some installers may fetch this public package instead of the intended private one. Upon installation, its postinstall.js script generates a per-installer UUID stored in the local cache directory and sends this identifier along with version and timestamp information to a hardcoded external endpoint (npx-monitor-76056.azurewebsites.net/api/pingback). This postinstall lifecycle hook executes unconditionally, causing attacker-controlled JavaScript to run on the installer's machine and leaking installation data to a non-vendor server. The package.json describes this as a dependency-confusion proof-of-concept, but the impact and mechanism are equivalent to a real dependency confusion attack against Apple's private namespace.

Installation of the malicious cktool-core package results in execution of attacker-controlled code on the installer's machine during the postinstall phase. It also causes exfiltration of a unique installer identifier, version, and timestamp to an external attacker-controlled server. This can lead to unauthorized data disclosure and potential further compromise depending on the attacker's payload. The attack exploits dependency confusion, where a private scoped package is resolved incorrectly to a public malicious package.

No official patch or remediation is currently documented. Users should verify that their package resolvers correctly resolve scoped packages to the intended private registries to avoid fetching this malicious public package. Avoid installing cktool-core versions 1.0.0, 1.0.1, and 1.0.2 from the public npm registry. Monitor vendor advisories for updates or official fixes. Since this is not a cloud service, remediation depends on user-side resolver configuration and package source verification.