Cybersecurity researchers discovered a set of seven npm packages published by a single attacker. The package leverages a cloaking service called Adspect to distinguish between real victims and security researchers, ultimately redirecting them to a sketchy crypto-themed site.
Below are malicious npm packages published by a threat actor named ‘dino_reborn’ between September and November 2025. As of this writing, npm accounts do not exist on npm.
signal-embed (342 downloads) dsidospsodlks (184 downloads) applicationooks21 (340 downloads) application-phskck (199 downloads) integrator-filescrypt2025 (199 downloads) integrator-2829 (276 downloads) integrator-2830 (290 downloads)
“When you visit a fake website built by one of our packages, the attacker determines whether the visitor is a victim or a security researcher,” said Olivia Brown, a security researcher at Socket.
“If the visitor is the victim, they will see a fake CAPTCHA and eventually be redirected to a malicious site. If the visitor is a security researcher, knowing just a few pieces of information on the fake website is enough to know that something malicious may be going on.”
Six of these packages contain 39kB of malware that incorporates cloaking mechanisms to capture system fingerprints. At the same time, it takes steps to evade analysis by blocking developer interactions in web browsers, effectively preventing researchers from viewing source code or launching developer tools.
This package leverages a JavaScript feature called Immediately Invoked Function Expression (IIFE), which allows malicious code to be executed as soon as it is loaded in a web browser. In contrast, “signals-embed” does not contain any malicious functionality and is designed to construct a decoy white page.
The information obtained is sent to a proxy (‘association-google’).[.]xyz/adspect-proxy[.]php”) to determine whether the traffic source is from a victim or a researcher and deliver a fake CAPTCHA. Once the victim clicks on the CAPTCHA checkbox, they are directed to a fake cryptocurrency-related page that impersonates a service like StandX and steals digital assets.
However, if a visitor is flagged as a potential researcher, a white decoy page is displayed to the user. It also contains HTML code related to a display privacy policy associated with a fake company named Offlido.
According to Adspect’s website, Adspect promotes a cloud-based service designed to protect ad campaigns from unwanted traffic such as click fraud and antivirus company bots. It also claims to offer “bulletproof cloaking” and “reliably cloak any advertising platform.”
There are three plans: Ant-fraud, Personal, and Professional, priced at $299, $499, and $999 per month. The company also claims users can promote “anything they want,” adding that it follows a no-questions-asked policy. That is, it doesn’t care what users do and doesn’t enforce any content rules. ”
“Adspect cloaking is rarely used within npm supply chain packages,” Socket said. “This is an attempt to integrate traffic cloaking, anti-research controls, and open source distribution. By embedding Adspect logic in npm packages, attackers can distribute a self-contained traffic gating toolkit that automatically decides which visitors to expose to the real payload.”
Source link
