Fake https://corepack.org site

@wwuck

Warning ‼️

Do not access the fake site corepack[dot]org ❌

Danger of malicious links!

Currently hosted by cloudflare which responds with a "Suspected Phishing" message, allowing override and site visit (not recommended however, unless you are a security researcher!)

Fake Corepack Site Distributes Infostealer and Proxyware to Developers from Socket, Jul 24, 2026 reports on site analysis.

Can the website https://corepack[dot]org get updated for the new commands documentation?

Originally posted by @wwuck in #624

@MikeMcC399

Thanks @MikeMcC399. It was the second top search result when I searched for corepack on duckduckgo.

Their FAQ seems to be entirely LLM-generated:

@nodejs/marketing is there something we can / should do to reduce the risk for user to confuse it with a genuine website?

@bensternthal

It might, however, be a copyright/trademark issue that OpenJS could look into - cc @bensternthal.

I've opened https://openjs-foundation.slack.com/archives/C06LTLUK9NZ/p1773340514364099 to discuss further and bring up the risk that this may be preparation for a supply-chain attack.

sus

Is yarn bombing illegal?

Yarn bombing (decorating public spaces with knitted or crocheted yarn) is usually considered street art. Its legality depends on local laws. In some places it may be treated as vandalism if done without permission, while in others it is tolerated as public art.

As noted in #878 , the site is now offering downloads. Links on this site should be considered dangerous and may be malicious.

For what it's worth, I've reported this domain (corepack.org) to the registrar (spaceship.com) via their abuse@spaceship.com email address. Perhaps they'll be reasonable and take it down. I'll report back what I hear.

@jeremywiebe

@jeremywiebe

Did you get any response from abuse@spaceship.com ? If not, perhaps you could forward them the link to the detailed socket.dev analysis?

@MikeMcC399

@MikeMcC399 No reply yet! I don't see a problem with multiple people submitting an abuse report. This is a pretty sketchy site that is very much a malware site. This falls directly under their abuse reporting types. I'll forward this link along in a second report!

https://www.spaceship.com/legal/how-to-report-abuse-incidents-in-spaceship/

I think a bonus outcome from this report would be that this project could hopefully gain control of this domain. :)

I've reached out to the ISP as well to make them aware

The ISP has responded. 24 hours from now, we should have this site down :-)

We have notified the client regarding the abuse.
They have 24 hours to take necessary action. If you still notice
the abuse after 24 hours, kindly reply to this ticket and we will
null the IP address.

corepack[dot]org has been taken down, and now returns 404 on all pages.

corepack[dot]org has been taken down, and now returns 404 on all pages.

Great teamwork!

FWIW I also managed to get https://safeweb.norton.com/ to classify it as dangerous.
I submitted it to Google Search for removal from search results as well.

Only other follow up might be to wait for the domain to expire on January 25, 2027 and have the OpenJS Foundation buy the domain to redirect it to the appropriate place.

Though that only works if the current owner doesn't renew.

I had that thought too. I’ve submitted an abuse report to both the host and registrar (spaceship.com) so it may become available sooner and not be renewable by that customer. I’m unsure how that works.

Re-opening for awareness, as https://corepack[dot]org is currently serving the same page as described in the report:

Fake Corepack Site Distributes Infostealer and Proxyware to Developers from Socket, Jul 24, 2026.

Ugh! I'll follow-up with the ISP

Okay, so they got sneaky and changed their ISP... however, their new ISP is Cloudflare, so I reached out to them

@MikeMcC399

@MikeMcC399

Navigation Menu

Repository navigation

Fake https://corepack.org site #803

2 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Fake https://corepack.org site #803

Description

Activity

MikeMcC399 commented on Mar 9, 2026

wwuck commented on Mar 9, 2026

aduh95 commented on Mar 9, 2026

aduh95 commented on Mar 9, 2026

MikeMcC399 commented on Mar 9, 2026

MikeMcC399 commented on Mar 12, 2026

ljharb commented on Mar 12, 2026

MikeMcC399 commented on Mar 12, 2026

DiegoFleitas commented on May 15, 2026

MikeMcC399 commented on Jul 22, 2026

jeremywiebe commented on Jul 22, 2026

2 remaining items

MikeMcC399 commented on Jul 24, 2026

jeremywiebe commented on Jul 24, 2026

avivkeller commented on Jul 24, 2026

avivkeller commented on Jul 24, 2026

avivkeller commented on Jul 25, 2026

MikeMcC399 commented on Jul 26, 2026

MikeMcC399 commented on Jul 26, 2026

styfle commented on Jul 27, 2026

jeremywiebe commented on Jul 27, 2026

MikeMcC399 commented on Aug 15, 2026

avivkeller commented on Aug 15, 2026

avivkeller commented on Aug 15, 2026

avivkeller commented on Aug 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions