[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fB1lGS7K8jD8qlVGN6za0ZaJeYr5qWNh9I0X2hZOxi1k":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"b7982097-7755-41f3-bfe7-35347fd8061d","fake-corepack-site-tricks-developers-into-installing-infostealer-malware","64249b92-42f8-482b-86ee-fb9983bb181d","Fake Corepack Site Tricks Developers into Installing Infostealer Malware","Attackers exploited developer confusion following Corepack's removal from Node.js by registering a lookalike domain (corepack[.]org) and distributing trojanized executables. This is a classic supply chain and social engineering attack targeting the software development ecosystem, where developers inherently trust tools they believe are official. The malware installs an infostealer capable of harvesting credentials and sensitive data, while also enrolling victim machines into a proxy network for further abuse. This incident highlights how ecosystem disruptions — such as a tool being deprecated or moved — create windows of opportunity that threat actors quickly exploit.","**Immediate actions:**\n- Verify all development tool downloads exclusively through official sources such as the official Node.js GitHub organization or npmjs.com registry.\n- Warn your development team immediately about the fake corepack[.]org domain and block it at the DNS or web proxy level.\n- Scan developer workstations for indicators of compromise associated with this campaign using up-to-date EDR tooling.\n\n**Long-term improvements:**\n- Establish an approved software catalog and require developers to obtain tools only from vetted, organization-approved sources.\n- Implement a software supply chain policy that mandates checksum\u002Fhash verification and code-signing validation for all downloaded executables.\n- Subscribe to ecosystem security advisories (e.g., npm security advisories, Node.js security releases) to get early warning of ecosystem changes that attackers may exploit.\n\n**Detection measures:**\n- Deploy DNS filtering and web proxy rules to block newly registered typosquatting domains targeting common developer tools.\n- Monitor endpoints for unexpected outbound proxy traffic or credential-harvesting behavior indicative of infostealer or proxyware activity.\n- Enable behavioral EDR alerts for developer workstations that flag unsigned executables downloaded from non-approved domains.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SA-12: Supply Chain Protection","NIST AT-2: Security Awareness Training","NIST SI-3: Malicious Code Protection","NIST PR.AT-1: Awareness and Training (CSF)","NIST ID.SC-3: Supply Chain Risk Management (CSF)","GDPR Article 32: Security of Processing (if developer credentials\u002FPII are exfiltrated)",{},"published","2026-07-24T16:20:37.327892+00:00","2026-07-24T16:20:37.266+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsocket.dev\u002Fblog\u002Ffake-corepack-site-distributes-infostealer-and-proxyware?utm_medium=feed","fake-corepack-site-distributes-infostealer-and-proxyware-to-developers-efb305","Fake Corepack Site Distributes Infostealer and Proxyware to Developers",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"930bbc16-25e4-42e2-9b08-bcca9eb8f473","2026-07-25","morning","ThreatNoir Weekend Brief — July 25","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-25\u002Fthreatnoir-morning-brief-2026-07-25.mp3",[51,55,59],{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]