Malicious code in mapkit-loader (npm)

The unscoped npm package 'mapkit-loader' (version 1.0.0) impersonates the official scoped '@apple/mapkit-loader' package to exploit user mistyping during 'npx mapkit-loader' commands. Its postinstall lifecycle script unconditionally sends an HTTPS POST request to a hardcoded third-party endpoint with a persistent UUID stored in the user's cache directory, package version, trigger source, and timestamp. This allows the attacker to track installations and executions of the package on victim hosts. There is no evidence of credential or filesystem data exfiltration. This is a supply-chain typosquatting attack with an operational tracking channel.

The primary impact is operational tracking of users who mistakenly install or run the malicious package due to name confusion. While no direct credential theft or filesystem compromise is reported, the presence of a persistent identifier and external beaconing can lead to privacy violations and targeted follow-up attacks. This undermines trust in the npm ecosystem and can facilitate further malicious activity if combined with other exploits.

Users should avoid installing the unscoped 'mapkit-loader' package and instead use the official scoped '@apple/mapkit-loader'. Audit dependencies carefully to detect typosquatting packages. Since no patch or fix is available for the malicious package itself, the best mitigation is to remove it from projects and registries and educate users about the risk of similarly named packages. Monitor for any unexpected network activity related to the described endpoint.