Fake Corepack tool site goes quiet after luring devs with malware

Node.js developers looking for the Corepack toolset have been targeted by a fake website that offered up malware to them, security researchers say.

Corepack shipped as an experimental feature bundled with Node.js from version 16.9.0, giving developers a single tool to pin and switch between package managers.

In 2025, the Node.js Technical Steering Committee voted to stop distributing Corepack.

Node.js 25 dropped it from the default bundle entirely.

That change is what unknown threat actors have been taking advantage of by setting up a fake malicious site, Corepack.org, a technical report by software supply chain security vendor Socket.dev suggests.

Developers looking for a replacement download currently see the fake site as the second DuckDuckGo result for a plain search of the tool's name.

The site has existed in a low-quality, apparently artificial intelligence-generated form since early 2026, but it only recently began offering an executable download, Socket said.

Running the installer drops an infostealer capable of reaching browser profile data and stored SSH keys, alongside a persistent component that survives a reboot.

The same payload enrols the machine in a bandwidth-sharing scheme, quietly turning the victim's internet connection into an exit node for someone else's traffic.

Security vendors call this practice proxyjacking, and it leaves the machine's owner with no visibility into what traffic is routing through their own connection.

A second click path on the same site leads to a different chain entirely, ending in a fake "your file is ready" page that installs a disguised Opera GX setup file instead.

Corepack is distributed as a npm package rather than a downloadable installer, so the safest route is to do npm install -g corepack to obtain it from the official npm registry.

Following developer community reporting, the hosting provider for the malicious site appears to have acted on an abuse notification; the site now only serves up a 404 message, with no further content available.