Malicious Npm Packages Abuse Adspect Cloaking in Crypto Scam

Malicious npm packages are abusing Adspect cloaking to run a crypto scam, with Socket Threat Research identifying seven such packages distributed by a threat actor using the online handle “dino_reborn,” according to a blog post. The malware campaign embeds code that can determine whether a visitor is a potential victim or a security researcher, then directs them to different experiences, including a fake CAPTCHA for victims and a different redirect for researchers.

The actor uses Adspect to cloak content, feeding a high-fidelity fingerprint of the visitor—including the real IP address—to an Adspect API via the actor’s proxy endpoint, enabling selective delivery. Six of the packages (dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, integrator-2830) carry the 39 kB malware and differ mainly in Adspect configuration, while the seventh, signals-embed, builds a malicious web page.

The researcher notes that these poisoned npm packages have been removed from the registry after npm was informed, and defenders are urged to watch for Adspect-like cloaking and related proxy infrastructure. November 18, 2025.