Fake https://corepack.org site

[MikeMcC399]

Warning ‼️

Do not access the fake site corepack[dot]org ❌

Danger of malicious links!

Currently hosted by cloudflare which responds with a "Suspected Phishing" message, allowing override and site visit (not recommended however, unless you are a security researcher!)

Fake Corepack Site Distributes Infostealer and Proxyware to Developers from Socket, Jul 24, 2026 reports on site analysis.

---

Can the website https://corepack[dot]org get updated for the new commands documentation?

Originally posted by @wwuck in #624

[MikeMcC399]

There is no indication of the owner of this site or who created it.

[wwuck]

Thanks @MikeMcC399. It was the second top search result when I searched for corepack on duckduckgo.

[aduh95]

Their FAQ seems to be entirely LLM-generated:

[aduh95]

@nodejs/marketing is there something we can / should do to reduce the risk for user to confuse it with a genuine website?

[MikeMcC399]

The Download link in the header is misspelled as "Downlaod" and the download link file https://corepack.org/wp-content/uploads/2026/02/corepack-main.zip doesn't exist.

[MikeMcC399]

I'm going to close this issue, as the website https://corepack.org is not under the control of this repo, or even under the control of the Node.js organization.

The site is a poor, incomplete and outdated attempt to present Corepack. There have been recent updates to the site, nevertheless the information is still quite outdated and incorrect.

The screenshot in #803 (comment) suggests that the site was created using AI, that confused "yarn" as in textiles with Yarn the package manager.

There is no indication on the site of who created it.

[ljharb]

It might, however, be a copyright/trademark issue that OpenJS could look into - cc @bensternthal.

[MikeMcC399]

I've opened https://openjs-foundation.slack.com/archives/C06LTLUK9NZ/p1773340514364099 to discuss further and bring up the risk that this may be preparation for a supply-chain attack.

[DiegoFleitas]

sus

Is yarn bombing illegal?

Yarn bombing (decorating public spaces with knitted or crocheted yarn) is usually considered street art. Its legality depends on local laws. In some places it may be treated as vandalism if done without permission, while in others it is tolerated as public art.

[MikeMcC399]

As noted in #878 , the site is now offering downloads. Links on this site should be considered dangerous and may be malicious.