Is beadpie.xyz safe?

Named in a fake developer-tool malware campaign

Threat research describes attackers using a fake corepack.org site to hand out malware disguised as the legitimate npm Corepack developer tool, targeting developers who land there looking for a download.

beadpie.xyz appears in that campaign's indicator list, in the same set as corepack.org, freevpn.win, yakteam.xyz and other domains, alongside a dropped installer name.

That listing is the strongest single fact here: it ties this host to a distribution chain that pushes malicious files rather than to any ordinary website.

Technical verdicts are adverse; the operator stays unknown

A saved antivirus observation records 15 independent engine families returning adverse results, with categories including malware, phishing and spyware-and-malware. It is a stored observation rather than a fresh submission, so the timing is uncertain, but the volume of adverse verdicts is not a single false positive.

Independent scanner records add a 'suspicious site' classification and a global traffic index scan result marking the URL as malicious.

Nothing about the operator could be established: the site's own page, contact, About and policy text was never reviewed because the server answered HTTP 405 on both schemes. Registration is through a privacy service, so no owner is disclosed.

What points the other way, and why it does not outweigh the rest

The browser threat feed returned no threat warning for the host, and the hosting IP carries an abuse confidence score of 0/100 across two saved reports. The domain is also 482 days old, so this is not a freshly created throwaway.

Those points soften the picture but do not clear it: a clean Safe Browsing result means no current listing, not that the host is safe, and it conflicts directly with the antivirus aggregate and the campaign listings. A valid TLS certificate exists, yet the scanned address was served over plain HTTP with no redirect to HTTPS, so the observed connection was unencrypted.