Fake Corepack Site Distributes Infostealer and Proxyware to Developers

A website at corepack[.]org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download. The site has existed in some form since early 2026 as a low-quality, apparently AI-generated imitation, but it recently started serving executable downloads. Socket’s Threat Research team analyzed the site and confirmed it as a developer-targeted phishing and impersonation operation that drops an infostealer and enrolls victims’ machines in a bandwidth-sharing proxy network.