{"slug": "fake-corepack-site-distributes-infostealer-and-proxyware-to-developers", "title": "Fake Corepack Site Distributes Infostealer and Proxyware to Developers", "summary": "A fake website at corepack[.]org is impersonating the Node.js Corepack tool and distributing malware to developers, Socket's Threat Research team reported. The site delivers an infostealer that accesses browser-profile data and SSH keys, and enrolls victims' machines in a bandwidth-sharing proxy network via OpenShield. The impersonation exploits Corepack's removal from Node.js 25, targeting developers searching for a standalone download.", "body_md": "A website at corepack[.]org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download. The site has existed in some form since early 2026 as a low-quality, apparently AI-generated imitation, but it recently started serving executable downloads. Socket's Threat Research team analyzed the site and confirmed it as a developer-targeted phishing and impersonation operation that drops an infostealer and enrolls victims' machines in a bandwidth-sharing proxy network.\n\nCorepack is not distributed as a Windows installer, and the real project has no official website at corepack.org. Any download offered there should be treated as malicious.\n\nCorepack's Removal From Node.js Creates an Opening#\n\nCorepack is an npm package that lets developers manage package managers like Yarn and pnpm and pin a specific version per project. It shipped as an experimental feature bundled with Node.js starting in version 16.9.0.\n\nIn 2025, the Node.js Technical Steering Committee voted to stop distributing Corepack with future releases. It remains available in Node.js 24 and earlier, and Node.js 25 stopped bundling it. Developers who still want Corepack now install it themselves, most commonly from the npm registry.\n\nThe attackers are exploiting that transition. Developers searching for how to get Corepack after its removal from Node.js are the exact audience most likely to click a top search result that promises a download. In a Node.js issue tracking the domain, one contributor reported corepack.org showing up as the second result when searching for \"corepack\" on DuckDuckGo.\n\nThe Download Delivers an Infostealer and Proxyware#\n\nClicking \"Download Free\" on the site redirects the visitor to an OpenShield landing page and downloads a file named vpnsetup_d9gfqvs3dsic73fcvi90.exe, presented as a free VPN client. The tool has nothing to do with Corepack.\n\nWhen executed, the installer drops OpenShield along with a persistent Apprunner component. Socket classifies the payload as an infostealer. Dynamic analysis confirmed:\n\nAccess to browser-profile data and stored SSH keys\n\nHost and process discovery\n\nPowerShell and command-shell execution\n\nRun-key persistence to survive reboots\n\nOpenShield also enrolls the system in bandwidth sharing for third-party data-scraping traffic, effectively turning the machine into a proxy exit node. Hidden bandwidth-sharing installs of this kind are known as proxyjacking, and security vendors classify the clients as proxyware or riskware because the person running the machine has no visibility into what traffic routes through their connection.\n\nA Second Path Delivers Adware and Trojan Activity#\n\nA different click path on the same site enters a malvertising or affiliate redirect chain and displays a fake \"Your File Download Is Ready\" page. Clicking through downloads OperaGXSetup.exe. This branch is best described as deceptive adware-style software delivery, and the overall detonation was also flagged as trojan activity.\n\nTwo distinct delivery paths from a single fake domain point to a monetization setup that pays out through more than one channel: an infostealer and proxy enrollment on one side, affiliate or adware installs on the other.\n\nThe impersonation is sloppy in ways that point to automated content generation with no understanding of the subject. The site's FAQ reads as LLM-generated, and in at least one answer it confuses the Yarn package manager with yarn the textile craft, responding to a question about \"yarn bombing\" as if the tool were related to knitting and crochet street art. The download link in the header is misspelled \"Downlaod,\" and one advertised download archive did not exist when contributors checked it. The site gives no indication of who created it.\n\nThis is the same low-effort, high-volume impersonation pattern we've seen for years across the ecosystem, where lookalike domains and typosquats for trusted developer tools are spun up quickly and cheaply, then wired to a malware or affiliate backend.\n\nNode.js contributors flagged corepack.org in issue #803 on the nodejs/corepack repository, opened in March 2026. At the time, the site was only a poor, outdated informational page with no downloads, and a maintainer initially closed the issue as out of scope since the domain is not controlled by the project or the Node.js organization. The concern that it could be preparation for a supply chain attack was raised early and taken to the OpenJS Foundation, along with a possible trademark and copyright question over the Corepack name.\n\nThe issue was reopened once the site began offering downloads. Maintainers pinned it, marked a duplicate report, and warned that links on the site should be considered dangerous. A developer has reported the domain to the registrar through its abuse contact, and the situation now more clearly meets the criteria for anti-abuse action than it did when the site carried no downloads.\n\nCorepack is an npm package, not a standalone application, and there is no official installer at corepack.org. Install it from the npm registry with npm install -g corepack, or follow the instructions in the official nodejs/corepack repository. Treat any developer tool offered as a downloadable .exe from an unfamiliar domain as suspect, and confirm you are on an official project source before running anything.\n\nThe White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.", "url": "https://wpnews.pro/news/fake-corepack-site-distributes-infostealer-and-proxyware-to-developers", "canonical_source": "https://socket.dev/blog/fake-corepack-site-distributes-infostealer-and-proxyware?utm_medium=feed", "published_at": "2026-07-24 14:55:18+00:00", "updated_at": "2026-07-24 15:39:13.388174+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools"], "entities": ["Socket", "Corepack", "Node.js", "OpenShield", "DuckDuckGo", "Yarn", "pnpm"], "alternates": {"html": "https://wpnews.pro/news/fake-corepack-site-distributes-infostealer-and-proxyware-to-developers", "markdown": "https://wpnews.pro/news/fake-corepack-site-distributes-infostealer-and-proxyware-to-developers.md", "text": "https://wpnews.pro/news/fake-corepack-site-distributes-infostealer-and-proxyware-to-developers.txt", "jsonld": "https://wpnews.pro/news/fake-corepack-site-distributes-infostealer-and-proxyware-to-developers.jsonld"}}