Fake Corepack Site Distributes Infostealer and Proxyware to Developers
Fake Corepack site impersonates Node.js tool to distribute infostealer and proxyware.
A malicious website impersonating the Node.js Corepack tool is distributing malware to developers. The fake site, corepack[.]org, lures developers seeking Corepack after its removal from Node.js, offering executable downloads that install an infostealer and enroll machines in a proxy network. A secondary download path delivers adware and trojan activity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Corepack?
Get an email when a new story names Corepack, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited developer confusion following Corepack's removal from Node.js by registering a lookalike domain (corepack[.]org) and distributing trojanized executables. This is a classic supply chain and social engineering attack targeting the software development ecosystem, where developers inherently trust tools they believe are official. The malware installs an infostealer capable of harvesting credentials and sensitive data, while also enrolling victim machines into a proxy network for further abuse. This incident highlights how ecosystem disruptions — such as a tool being deprecated or moved — create windows of opportunity that threat actors quickly exploit.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — corepack[.]org
- domain — openshield[.]canatrace[.]com
- domain — freevpn[.]win
- domain — moonlighthathel[.]org
- domain — aifpleasurebeh[.]org
- domain — ghabovethec[.]info
- domain — ukankingwithea[.]com
- domain — beadpie[.]xyz
- domain — yakteam[.]xyz
- domain — nostop[.]go2cloud[.]org