The cktool-core package on npm is a malicious package impersonating Apple's private @apple/cktool.core package. When installed due to resolver misrouting, it executes a postinstall script that generates a unique identifier and sends it, along with version and timestamp data, to an attacker-controlled external server. This behavior occurs unconditionally during installation, resulting in execution of attacker-controlled JavaScript and data exfiltration. The package is labeled as a proof-of-concept for dependency confusion but functions identically to a real attack targeting Apple's private namespace.