corepack.org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download.
highURL / phishing·
AGS-2026-0009
Fake Corepack Phishing Website
Self-check
This advisory includes an optional local inspection recipe. Delivery and automated execution depend on the account plan, connected integration, and the release path documented for your environment; verify before relying on it.
Remediation: block_url— corepack.org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download.
Indicators of Compromise：
vpnsetup_d9gfqvs3dsic73fcvi90.exe
OperaGXSetup.exe
corepack.org
openshield.canatrace.com/download-free-can/
freevpn.win/lps/gbox-lp/index.html
moonlighthathel.org
aifpleasurebeh.org
ghabovethec.info
ukankingwithea.com
beadpie.xyz
yakteam.xyz
nostop.go2cloud.org