Socket: Fake Corepack Site Distributes Infostealer and Proxyware to Developers

What it is

corepack.org — a fake site impersonating Corepack, the Node.js tool for managing package managers (Yarn, pnpm). It is not affiliated with the project; the real Corepack has no official website and is not distributed as a Windows installer. Any download offered at that domain is malicious.

How it works

Corepack shipped bundled with Node.js from 16.9.0 as an experimental feature. In 2025 the Node.js Technical Steering Committee voted to stop bundling it; it remains in Node.js 24 and earlier, and Node.js 25 dropped it. Developers now searching for how to obtain Corepack are the click-through audience the fake site targets — one contributor reported it appearing as the second DuckDuckGo result for "corepack." Two payout paths run from the one domain:

flowchart TD
    S[corepack.org fake site] --> D["Download Free"]
    S --> A[Second click path]
    D --> O[OpenShield landing page]
    O --> V[vpnsetup_d9gfqvs3dsic73fcvi90.exe]
    V --> INF[Infostealer + Apprunner persistence]
    V --> PROX[Proxyware / proxyjacking exit node]
    A --> M[Malvertising/affiliate chain] --> OP[OperaGXSetup.exe adware/trojan]

Preconditions / Affected

Windows developers who reach corepack.org via search and run a download. The site has existed as a low-quality, apparently AI-generated page since early 2026 and only recently began serving executables.

What to do

Corepack is an npm package, not a standalone app. Install from the npm registry:

npm install -g corepack

Or follow the official nodejs/corepack repository instructions. Treat any developer tool offered as a downloadable Windows installer from a lookalike domain as suspect.

Identifying signals of this fake (useful if you or a teammate landed there): the header download link is misspelled "Downlaod"; the LLM-generated FAQ confuses the Yarn package manager with textile yarn (answering a "yarn bombing" question as if about knitting); at least one advertised archive did not exist. The delivered file is a bogus "free VPN client" — vpnsetup_d9gfqvs3dsic73fcvi90.exe — that drops OpenShield with browser-profile and SSH-key access, PowerShell/shell execution, and run-key persistence, and enrolls the host as a bandwidth-sharing proxy exit node.

Caveats

Takedown is not complete. OpenJS reached the ISP, which gave the client 24 hours to address the abuse before nulling the IP — so the domain may still be live. The Node.js issue was initially closed as out of scope (the org doesn't control the domain) and only reopened once downloads appeared; there is an open trademark/copyright question over the Corepack name rather than a mechanism to force removal.