TLDR Tech / InfoSec
New PhantomRaven NPM attack wave steals dev data via 88 packages
PhantomRaven, an ongoing npm supply-chain campaign active since August 2025, has deployed 88 additional malicious packages across four attack waves, using slopsquatting to mimic projects like Babel and GraphQL Codegen with LLM-suggested package names. The campaign evades automated inspection via Remote Dynamic Dependencies (RDD), in which package.json points its dependencies to attacker-controlled external URLs, pulling and executing malware at npm install time rather than embedding it in the package itself. The payload harvests .gitconfig, .npmrc, environment variables, and CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI before exfiltrating to EC2-hosted C2 infrastructure, with 81 packages still live in the registry as of this writing.
Read the full story