npm Supply Chain Attack: Hackers Use Adspect Cloaking and Fake Crypto CAPTCHA to Deceive Victims and Researchers

The Socket Threat Research Team has uncovered a highly coordinated malware campaign across seven npm packages published by a threat actor using the alias “dino_reborn,” which employ Adspect-powered cloaking, anti-analysis JavaScript, and fake CAPTCHA interfaces to redirect victims to malicious payloads while evading security researchers. The campaign includes a fake website built to deceive researchers, with the attacker determining if a visitor is a victim or a researcher at visit time.

The seven packages—signals-embed, dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830—share code, APIs and infrastructure, forming an interconnected malware ecosystem, and six of them contain malware while one builds a malicious webpage. Adspect fingerprints visitors by collecting data such as user agent, host, referrer, port, locale, encoding, timestamps and browser language to decide whether to show a fake CAPTCHA or a decoy white page.

The fake CAPTCHA mirrors crypto platforms like standx[.]com, jup[.]ag or uniswap[.]org, and the eventual redirect leads to a malicious payload, with the seventh package, signals-embed, housing the decoy site called Offlido.