Fake Corepack Site Distributes Infostealer and Proxyware to Developers

A fraudulent site impersonating the Corepack project at corepack.org is distributing malicious Windows installers that deliver an infostealer (OpenShield/Apprunner) and enroll infected hosts in a bandwidth-sharing proxy network; an alternate delivery path pushes adware/trojans. Dynamic analysis shows credential and SSH key theft, persistence, and remote command execution; the report provides IOCs and documents community takedown efforts while advising developers to obtain Corepack from the npm registry.