ckeditor5-ckbox

GHSA-vc6v-j5rr-3h82

Malicious code in ckeditor5-ckbox (npm)

Details

**Severity:** Critical

**Affected versions:** `= 5.0.0`

## Source: amazon-inspector (9373ed3aa6afb53ef5d5d3dd4860a4ed9e7b151fdd8c5c7782f2b2e914810fc7)
Unscoped npm package ckeditor5-ckbox mimics the legitimate @ckeditor/ckeditor5-ckbox plugin. package.json declares a preinstall hook (`node index.js`) that runs on `npm install`. index.js collects installer machine identifiers — os.hostname(), os.userInfo() (username, uid, gid, shell), platform/arch, home directory, cwd, and the output of `whoami` and `id` executed via child_process — and POSTs the JSON to the hardcoded Burp Collaborator OAST domain https://shdu19bid9mc4e6lezjmldk0erki88wx.oastify.com/system-info. The package contains no CKEditor functionality; the sole payload is the install-time beacon. Author/description are empty and the name is a typosquat of the scoped legitimate package.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/ckeditor5-ckbox/MAL-2026-15549.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/e4956292c0cf024519ebae88e8b315a0af37a829/osv/malicious/npm/ckeditor5-ckbox/MAL-2026-15549.json
- https://www.npmjs.com/package/ckeditor5-ckbox/v/5.0.0
- https://github.com/advisories/GHSA-vc6v-j5rr-3h82

Compromised versions (1)

= 5.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.