Executive brief
The calk package on npm is a malicious typosquat designed to trick developers into installing it instead of a legitimate package with a similar name. Once installed, it silently collects and transmits information about the developer's environment (Node version, sudo status) to a remote server. This represents a supply chain risk that could allow attackers to identify and target specific development environments.
Technical details
This is a malicious package (CWE-506: Embedded Malicious Code) distributed via npm that performs typosquatting to trick developers into installing the wrong dependency. The package uploads telemetry data including the downloaded package name, intended package name, Node version, and sudo process status to a remote server, enabling reconnaissance of targeted developers. Attack vector is network-based with no authentication required—installation occurs when a developer makes a typing mistake during npm install. The malicious code executes at install time within the developer's environment. No patch is available; the sole remediation is package removal and verification of correct package names during installation.
Affected products
- npm calk all versions
Timeline
- 2020-09-02: disclosed