Fake Corepack Site Distributes Infostealer and Proxyware to Developers

Reported 25 Jul 2026 by otx · Severity: medium

A fraudulent website impersonating Corepack, the Node.js package manager tool, is distributing malware to developers. The attackers exploit timing around Corepack's removal from Node.js bundling, targeting developers searching for installation instructions. The site offers Window