PhantomRaven Malware Targets npm Developers
Cybersecurity researchers have discovered a new software supply chain attack named PhantomRaven. This threat targets the npm registry and steals sensitive data from developers’ systems. It collects GitHub tokens, CI/CD secrets, and authentication credentials.
The campaign began around August 2025. Since then, it has grown rapidly, spreading across 126 npm packages and accumulating over 86,000 installations. Therefore, thousands of developers could already be exposed.
How the Attack Works
Investigators found that the attacker hid malicious code inside dependencies fetched from an external source. Instead of retrieving files from trusted npm repositories, these packages connected to a fake domain under the attacker’s control.
As a result, the npm registry and automated scanners could not detect the hidden threat. To security systems, the packages appeared harmless, showing “zero dependencies.” However, this trick allowed the attacker to deliver any type of malicious payload later.
For example, the attacker could first distribute harmless code to gain trust, then secretly replace it with a malware update once adoption increased.
Malware Behavior and Data Theft
Once a developer installs one of these seemingly safe packages, a pre-install hook activates. This script downloads and executes the hidden malware.
The payload then scans the victim’s system, gathering email addresses, public IP data, and CI/CD environment details. It fingerprints the entire system and sends all stolen data to a remote command server controlled by the attacker.
Researchers also noted that the attacker cleverly used a tactic called slopsquatting. This method exploits mistakes made by AI tools that generate fake but realistic-sounding package names. Developers may trust these names, unknowingly downloading infected code.
Why PhantomRaven Is So Dangerous
Experts say PhantomRaven exposes weaknesses in current security tools. Traditional scanners fail to detect Remote Dynamic Dependencies, which attackers can manipulate anytime. Furthermore, lifecycle scripts in npm allow automatic code execution during installation, often without user consent.
Therefore, attackers can hide their operations inside normal package behavior, making the malware extremely difficult to detect.
How to Prevent Such Attacks
To stay safe, developers should verify package sources, review dependency URLs, and disable automatic lifecycle scripts when possible. Advanced threat detection platforms offering real-time monitoring, supply chain visibility, and malware analysis can block hidden dependencies before they cause damage.
Continuous scanning and behavioral analysis also help prevent future infections across developer environments.
Sleep well, we got you covered.
