cktool-core@1.0.0

One or more suspicious static signals were detected.

npm install lifecycle postinstall

Tracks affected installs and confirms dependency-confusion resolution from consuming environments.

install-time telemetry beacon with persistent ID

On npm install, the postinstall hook runs postinstall.js. It reads or creates a stable UUID in the user's cache directory, builds a JSON payload containing that ID, package version, install source, and timestamp, then POSTs it to an Azure endpoint. The package describes itself as a dependency confusion PoC targeting the unscoped cktool-core name rather than Apple's @apple/cktool.core.

Source inspection confirms install-time network telemetry and persistent identifier creation in a package explicitly positioned for dependency-confusion testing. Even without credential theft or command execution, unconsented lifecycle beaconing from a confusion package is concrete attack behavior suitable for blocking.