Malicious npm Packages Abuse Adspect Redirects
Researchers at Socket have discovered seven malicious packages in npm that exploit the Adspect cloud service to mask their activity while redirecting victims to cryptocurrency scam websites.
Adspect markets itself as a tool for protecting websites from bots. However, this campaign demonstrates the service can serve the opposite purpose—concealing malicious activity from detection.
Security specialists identified all seven packages published between September and November 2025 by a developer using the username dino_reborn (geneboo@proton[.]me). Six contained malicious code designed to collect user data for determining whether traffic originated from researchers or potential victims. The seventh package (signals-embed) functioned as a decoy page:
- signals-embed
- dsidospsodlks
- applicationooks21
- application-phskck
- integrator-filescrypt2025
- integrator-2829
- integrator-2830
The malicious payload consisted of approximately 39 KB of JavaScript that executed automatically upon page load through an IIFE (Immediately Invoked Function Expression). When developers incorporated the malicious package into their web applications, the script loaded directly through users' browsers.
The malicious code employed multiple anti-analysis techniques. It blocked right-clicks, F12, and key combinations Ctrl+U and Ctrl+Shift+I. When DevTools detection occurred, the script simply reloaded the page. Simultaneously, the malware performed browser fingerprinting, collecting information about user agent, language, protocol, host, referrer, URI, query parameters, encoding, and other identifying data. The code transmitted all collected data to the attackers' proxy server while sending victims' real IP addresses to the Adspect API.
Users meeting the attackers' targeting criteria were redirected to a fake CAPTCHA page displaying Ethereum or Solana logos. This triggered a fraudulent sequence that opened a specific Adspect URL in a new tab, disguising the action as user-initiated.
When the script detected examination by security researchers, it loaded a fake but harmless page impersonating the company Offlido.
Following publication of Socket's research, npm removed all seven malicious packages from its repository.
