Researchers Identify Three New PhantomRaven npm Attack Waves

Summary

Endor Labs identified three PhantomRaven waves from November 2025 to February 2026, distributing 88 npm packages. Researchers say the packages fetch malware remotely to steal developer configuration, CI/CD tokens and system data; 81 reportedly remain available.

Key points

Koi first identified PhantomRaven in October 2025 and said it had published 126 malicious packages since August; Endor Labs found three later waves with 88 packages distributed through 50 disposable accounts.
Endor Labs reported that 81 malicious packages remained available in the npm registry.
The attackers used slopsquatting and LLM-like package names to impersonate projects including Babel and GraphQL Codegen.
Remote Dynamic Dependencies in package.json point to external dependencies; running npm install downloads and executes the malware, helping it evade automated package inspection.
The malware collects data from .gitconfig, .npmrc and environment variables, targets CI/CD tokens for GitHub, GitLab, Jenkins and CircleCI, and gathers system details.
Researchers say the malware exfiltrates data to attacker servers, usually with HTTP GET requests, with HTTP POST and WebSocket also used.
Endor Labs observed consistent infrastructure across four waves and nearly unchanged payload code, alongside attackers rotating accounts, package metadata and PHP endpoints.

Article Details

Attack Vectors: PhantomRaven used slopsquatting and LLM-like package names to publish malicious packages impersonating established projects on npm.
The packages used Remote Dynamic Dependencies in package.json to fetch malware from external servers when a developer ran npm install.
The malware collected configuration data, environment variables, and CI/CD tokens, then sent the stolen data to attacker C2 servers using HTTP GET, HTTP POST, or WebSocket.
Defensive Notes: Verify the legitimacy of software dependencies and use packages from reputable publishers.
Avoid copying package suggestions from AI chatbots or other unvetted sources.

MITRE ATT&CK

T1005 · Data from Local SystemThe malware collected local .gitconfig and .npmrc data, environment variables, and system information.T1041 · Exfiltration Over C2 ChannelThe malicious package exfiltrated collected data to attacker C2 servers.T1059.007 · JavaScriptThe malicious dependency was automatically executed during npm install in the JavaScript development environment.T1071.001 · Web ProtocolsThe article reports C2 data transfers using HTTP GET and POST requests and WebSocket.T1082 · System Information DiscoveryThe malware collected system information including hostname, operating system, and Node version.T1105 · Ingress Tool TransferRunning npm install caused a dependency containing malware to be downloaded from an external attacker server.T1195.001 · Compromise Software Dependencies and Development ToolsThe campaign distributed malicious npm packages that caused malware to be fetched and executed as a dependency.T1552.001 · Credentials In FilesThe malware harvested information from local .gitconfig and .npmrc files, along with CI/CD tokens.

Threat Actors

PhantomRavenThe article attributes malicious npm package waves, data collection, and exfiltration to the PhantomRaven campaign and its threat actor.

Products

CircleCICI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI platforms are also targeted GitHubCI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI platforms are also targeted GitLabCI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI platforms are also targeted JenkinsCI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI platforms are also targeted npmNew waves of the PhantomRaven supply-chain campaign are targeting the npm registry with dozens of malicious packages designed to exfiltrate sensitive data from JavaScript developers.