PhantomRaven
PhantomRaven is an npm supply-chain malware campaign targeting JavaScript developers through malicious npm packages. Reporting cited here attributes at least 126 malicious npm packages to the campaign, with later waves adding 88 more malicious packages between November 2025 and February 2026, including packages impersonating trusted projects such as Babel and GraphQL Codegen. The campaign was reported by Koi Security and analyzed by Endor Labs.
Its defining tradecraft is hiding malicious functionality in remote or hidden dependencies rather than in the visible package contents. The campaign abuses npm URL-based dependency fetching, described as Remote Dynamic Dependencies (RDD), so packages can appear benign or dependency-free to static analysis while npm retrieves attacker-hosted code at install time. The fetched dependency executes automatically via preinstall scripts. Researchers also reported IP-based targeting, allowing the operators to serve benign content to researchers while delivering malicious payloads to intended victims.
Documented theft includes npm tokens, GitHub credentials, GitHub tokens, GitLab tokens, developer emails from .npmrc and .gitconfig, environment-variable data, CI/CD secrets, and tokens or credentials associated with CircleCI and Jenkins. The malware also collected system details from infected systems. Multiple reports describe the campaign as stealing authentication tokens, developer secrets, and CI/CD credentials from developer machines across platforms.
The campaign began in August 2025 and remained active into at least February 2026. Koi Security reported more than 86,000 downloads across the malicious packages and traced payload hosting and exfiltration activity to packages.storeartifact.com. The operators reportedly rotated npm accounts, email accounts, package metadata, and PHP endpoints across waves while keeping infrastructure and payloads broadly consistent. Researchers also stated the campaign used AI-driven slopsquatting, registering plausible package names that could match hallucinated recommendations from tools such as GitHub Copilot and ChatGPT.
The threat actor is described as unknown in the provided content. High-confidence indicators mentioned in the content include the attacker-controlled domain packages.storeartifact.com, malicious npm packages using external URL-based dependencies, and exfiltration infrastructure and IP indicators published by Koi Security.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
2 techniques
Execution
Stealth
1 technique
Stealth
Credential Access
4 techniques
Credential Access
...exfiltrates emails from .npmrc, .gitconfig... GitHub, GitLab, CircleCI, and Jenkins CI/CD tokens...
...exfiltrates emails from .npmrc, .gitconfig, and environment variables...
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware delivered through malicious npm packages that steals developer-sensitive data, including emails from .npmrc, .gitconfig, and environment variables, CI/CD tokens from GitHub, GitLab, CircleCI, and Jenkins, and system details.
Malicious npm package campaign attributed to PhantomRaven, involving publication of numerous (88) malicious packages to the npm ecosystem.
Malware hidden in invisible dependencies within NPM packages.
PhantomRaven is a malware distributed via npm packages, hidden in invisible dependencies to evade detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.