PhantomRaven
PhantomRaven is the name given by Koi Security to a software supply chain campaign targeting developers through malicious npm packages. The activity is assessed to have begun in August 2025 and involved 126 malicious npm packages that accumulated more than 86,000 downloads. The packages were designed to steal authentication tokens, CI/CD secrets, GitHub credentials, npm tokens, environment variables, system metadata, email addresses, public IP information, and other developer secrets from compromised machines. The campaign used a technique described as Remote Dynamic Dependencies (RDD), in which npm dependencies are specified via attacker-controlled external URLs rather than standard npm-hosted packages. This caused some packages to appear to automated tools as having "0 dependencies" while still fetching malicious code at install time from infrastructure including packages.storeartifact.com. The fetched dependency executed automatically through npm lifecycle scripts, including preinstall hooks. Because the dependency content was hosted externally, operators could change payloads over time, selectively deliver benign content to researchers, and serve malicious payloads to corporate networks or other chosen targets based on request characteristics such as IP address. Koi Security also reported that the campaign leveraged "slopsquatting": registering plausible package names that may be hallucinated by large language models and then recommended by AI coding assistants. According to the reporting, some victims installed these packages based on AI-generated recommendations. Koi Security and related reporting also noted packages in the wild that included PhantomRaven malware as dependencies. The campaign specifically targeted developers and developer environments. Reported package examples associated with the activity include op-cli-installer, unused-imports, badgekit-api-client, polyfill-corejs3, and eslint-comments. Some reporting stated that certain packages impersonated tools from GitLab and Apache. Koi Security published indicators of compromise and said npm was reviewing and removing the malicious packages. Separately, Endor Labs reported malicious npm packages initially linked to PhantomRaven, but later noted they were claimed to have been created by a security researcher as part of a legitimate experiment; Endor Labs challenged that claim, citing excessive data collection, lack of transparency, and rotated publisher identities. This caveat applies to that subset of reporting. No nation-state attribution is stated in the provided content. No aliases beyond the same-name form "phantomraven" are provided in the content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Campaign involving malicious npm packages uploaded via disposable accounts, using Remote Dynamic Dependencies to deliver mutable payloads that steal environment variables, CI/CD tokens, and system metadata. The attribution is disputed in the content, with claims it may have been a security research experiment.
PhantomRaven is known for registering malicious npm packages with names that are likely to be hallucinated by AI assistants, leading developers to install malware through slopsquatting attacks.
PhantomRaven is conducting a large-scale software supply chain attack campaign targeting the npm registry. The group has published over 100 malicious npm packages designed to steal authentication tokens, CI/CD secrets, and GitHub credentials from developers' machines. The campaign leverages novel techniques to evade detection, such as hiding malicious code in dependencies fetched from attacker-controlled URLs and exploiting slopsquatting to register plausible-sounding package names.
PhantomRaven is a campaign targeting software developers via malicious npm packages to steal credentials and secrets, enabling further supply chain attacks.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.