Fake Corepack Site Distributes Infostealer and Proxyware to Developers

A malicious website at corepack[.]org impersonates the legitimate Corepack Node.js tool to distribute malware, targeting developers searching for the package after its removal from Node.js distributions. The site delivers an infostealer and enrolls victims in a proxyware network through a fake VPN installer, while a secondary path distributes adware and trojanized software. The operation leverages AI-generated content and deceptive infrastructure, indicating a low-effort, high-volume monetization scheme exploiting developer trust.

AI-extracted · verify before operational use