Poisoned Pipeline / Incidents / AS61
Fake corepack.org infostealer and proxyware
npmWindows softwareInstaller / update channel
After Node.js stopped bundling Corepack, Socket documented corepack.org
impersonating the Node.js package-manager pin tool. The real project
has no official site at that domain and is not distributed as a Windows
installer. “Download Free” redirected to an OpenShield landing page and
dropped vpnsetup_*.exe — an infostealer plus proxyware that enrolled
the machine as a bandwidth-sharing exit node. A second path delivered
OperaGXSetup.exe adware. Node.js contributors flagged the domain in
nodejs/corepack issue 803 (March 2026); it later started serving
executables. Install Corepack only from the npm registry.
Mapped techniques
- T0136 Brandjacking
- T0110 Advertise malicious artifact
- T0153 Compromised developer workstation
- T0184 Harvesting sensitive information from files
supply-chain brandjacked download site
corepack.org impersonating the Node.js Corepack tool.
Search-result download for developers after Corepack was unbundled.
Fake installer ran on the developer machine.
Browser profiles and stored SSH keys.