Seven npm Packages Use Adspect Cloaking to Trick Victims Into Crypto Scam Pages

Cybersecurity researchers have identified seven npm packages published by a single threat actor that use a cloaking service called Adspect to redirect victims to sketchy crypto scam pages. The malicious packages, published by a threat actor named "dino_reborn" between September and November 2025, include signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830, with the npm account no longer existing at the time of writing.

According to Socket security researcher Olivia Brown, visiting a fake site constructed by one package triggers a check to determine if the visitor is a victim or a security researcher, and victims see a fake CAPTCHA before being shipped to a crypto-themed site. Six of the packages carry a 39kB malware that embeds the cloaking mechanism and fingerprints the system while blocking developer tools to hinder analysis.

The traffic is proxied to a domain described as an Adspect proxy to decide whether to expose the payload, and Adspect markets itself as a cloud-based cloaking service offering “bulletproof cloaking” across advertising platforms.