A website at corepack[.]org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download. The site has existed in some form since early 2026 as a low-quality, apparently AI-generated imitation, but it recently started serving executable downloads. Socket's Threat Research team analyzed the site and confirmed it as a developer-targeted phishing and impersonation operation that drops an infostealer and enrolls victims' machines in a bandwidth-sharing proxy network.
Corepack is not distributed as a Windows installer, and the real project has no official website at corepack.org. Any download offered there should be treated as malicious.
Corepack's Removal From Node.js Creates an Opening#
Corepack is an npm package that lets developers manage package managers like Yarn and pnpm and pin a specific version per project. It shipped as an experimental feature bundled with Node.js starting in version 16.9.0.
In 2025, the Node.js Technical Steering Committee voted to stop distributing Corepack with future releases. It remains available in Node.js 24 and earlier, and Node.js 25 stopped bundling it. Developers who still want Corepack now install it themselves, most commonly from the npm registry.
The attackers are exploiting that transition. Developers searching for how to get Corepack after its removal from Node.js are the exact audience most likely to click a top search result that promises a download. In a Node.js issue tracking the domain, one contributor reported corepack.org showing up as the second result when searching for "corepack" on DuckDuckGo.
The Download Delivers an Infostealer and Proxyware#
Clicking "Download Free" on the site redirects the visitor to an OpenShield landing page and downloads a file named vpnsetup_d9gfqvs3dsic73fcvi90.exe, presented as a free VPN client. The tool has nothing to do with Corepack.
When executed, the installer drops OpenShield along with a persistent Apprunner component. Socket classifies the payload as an infostealer. Dynamic analysis confirmed:
Access to browser-profile data and stored SSH keys
Host and process discovery
PowerShell and command-shell execution
Run-key persistence to survive reboots
OpenShield also enrolls the system in bandwidth sharing for third-party data-scraping traffic, effectively turning the machine into a proxy exit node. Hidden bandwidth-sharing installs of this kind are known as proxyjacking, and security vendors classify the clients as proxyware or riskware because the person running the machine has no visibility into what traffic routes through their connection.
A Second Path Delivers Adware and Trojan Activity#
A different click path on the same site enters a malvertising or affiliate redirect chain and displays a fake "Your File Download Is Ready" page. Clicking through downloads OperaGXSetup.exe. This branch is best described as deceptive adware-style software delivery, and the overall detonation was also flagged as trojan activity.
Two distinct delivery paths from a single fake domain point to a monetization setup that pays out through more than one channel: an infostealer and proxy enrollment on one side, affiliate or adware installs on the other.
The impersonation is sloppy in ways that point to automated content generation with no understanding of the subject. The site's FAQ reads as LLM-generated, and in at least one answer it confuses the Yarn package manager with yarn the textile craft, responding to a question about "yarn bombing" as if the tool were related to knitting and crochet street art. The download link in the header is misspelled "Downlaod," and one advertised download archive did not exist when contributors checked it. The site gives no indication of who created it.
This is the same low-effort, high-volume impersonation pattern we've seen for years across the ecosystem, where lookalike domains and typosquats for trusted developer tools are spun up quickly and cheaply, then wired to a malware or affiliate backend.
Node.js contributors flagged corepack.org in issue #803 on the nodejs/corepack repository, opened in March 2026. At the time, the site was only a poor, outdated informational page with no downloads, and a maintainer initially closed the issue as out of scope since the domain is not controlled by the project or the Node.js organization. The concern that it could be preparation for a supply chain attack was raised early and taken to the OpenJS Foundation, along with a possible trademark and copyright question over the Corepack name.
The issue was reopened once the site began offering downloads. Maintainers pinned it, marked a duplicate report, and warned that links on the site should be considered dangerous. A developer has reported the domain to the registrar through its abuse contact, and the situation now more clearly meets the criteria for anti-abuse action than it did when the site carried no downloads.
Corepack is an npm package, not a standalone application, and there is no official installer at corepack.org. Install it from the npm registry with npm install -g corepack, or follow the instructions in the official nodejs/corepack repository. Treat any developer tool offered as a downloadable .exe from an unfamiliar domain as suspect, and confirm you are on an official project source before running anything.
The White House’s Gold Eagle Initiative aims to coordinate AI-discovered vulnerabilities, validate findings, and accelerate patching across critical software.