TLDR Tech / InfoSec
The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks (15 minute read)
Endor Labs identified 88 new malicious npm packages across three PhantomRaven waves (Waves 2–4) published between November 2025 and February 2026, with 81 packages still live and two C2 servers still active, both AWS EC2 instances running plaintext HTTP on port 80. The campaign abuses Remote Dynamic Dependencies (RDD) like HTTP URL entries in package.json that cause npm itself to fetch and execute a 259-line credential-harvesting payload from attacker infrastructure at install time, exfiltrating developer emails, CI/CD tokens, and full system fingerprints via triple-redundant GET/POST/WebSocket channels to PHP endpoints jpd.php and npm.php. Defenders should reject any npm package with non-registry URL dependencies, block outbound HTTP to domains matching the artifact-themed C2 pattern, and audit CI/CD pipelines for token exposure across the 50+ disposable npm accounts attributed to this operator.
Read the full story