A new supply chain attack dubbed PhantomRaven has flooded the npm registry with malicious packages that steal credentials, tokens, and secrets during installation. The packages appear safe when first downloaded, making them particularly difficult for security apps to identify.

According to [1]researchers at Koi , the campaign has been active since at least August 2025 and involves 126 malicious packages published by multiple accounts. At least 86,000 downloads were recorded before the campaign was exposed this week, and more than 80 of the infected packages were still live at the time of disclosure.

What sets PhantomRaven apart is its use of a new technique the researchers call Remote Dynamic Dependencies (RDD). Unlike typical npm malware, which relies on visible dependencies or post-install scripts, PhantomRaven packages initially appear empty – no dependencies, no suspicious code. But when a user installs them, the package fetches additional code from a remote server controlled by the attacker. The malicious payload is then executed locally, stealing data and exfiltrating it to the attacker's infrastructure.

[2]

This makes the attack extremely difficult to detect using conventional methods. Security tools that rely on static analysis of package metadata or dependency graphs will see nothing out of the ordinary, because the harmful code doesn't exist in the registry itself. Instead, it's dynamically retrieved during installation, leaving no obvious trace in the source files.

[3]

[4]

The stolen information includes npm and GitHub tokens, cloud credentials, SSH keys, and other sensitive environment variables commonly used in development and CI/CD pipelines. Koi said that the exfiltrated data was sent to a domain controlled by the threat actor, which used randomly generated subdomains for each victim to make tracking harder.

Koi's researchers noted that even experienced developers could be tricked because the packages use innocuous names, and some appear to have been automatically suggested by AI coding tools. The attackers also spread their uploads across multiple npm accounts, using disposable email addresses to avoid easy correlation.

[5]Self-propagating worm fuels latest npm supply chain compromise

[6]More packages poisoned in npm attack, but would-be crypto thieves left pocket change

[7]GitHub moves to tighten npm security amid phishing, malware plague

[8]Dev snared in crypto phishing net, 18 npm packages compromised

The team found that the packages disguised their true function by including harmless placeholder code, such as a "Hello World" script, to appear benign in the npm registry. Only when installed would they dynamically fetch and execute the real payload, bypassing static security checks entirely.

After analyzing the infrastructure and payloads, Koi said that the attacker's infrastructure was "surprisingly sloppy," but that they devised a "clever" method which could be reused by others. The campaign shows how easily malicious actors can abuse trust in public registries and highlights a new blind spot in existing software supply chain defenses.

[9]

"PhantomRaven demonstrates how sophisticated attackers are getting at exploiting blind spots in traditional security tooling," Koi researchers said. Remote Dynamic Dependencies aren't visible to static analysis. AI hallucinations create plausible-sounding package names that developers trust. And lifecycle scripts execute automatically, without any user interaction.

"These aren't theoretical vulnerabilities – they're active exploitation techniques affecting thousands of developers right now."

PhantomRaven shows that the real danger isn't always in the code itself, but in what it secretly fetches when you hit install. ®

Get our [10]Tech Resources



[1] https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aQOZqO8BfUWXkmjapjURzAAAAVc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQOZqO8BfUWXkmjapjURzAAAAVc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aQOZqO8BfUWXkmjapjURzAAAAVc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://www.theregister.com/2025/09/16/npm_under_attack_again/

[6] https://www.theregister.com/2025/09/09/npm_supply_chain_attack/

[7] https://www.theregister.com/2025/09/23/github_npm_registry_security/

[8] https://www.theregister.com/2025/09/08/dev_falls_for_phishing_email/

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aQOZqO8BfUWXkmjapjURzAAAAVc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://whitepapers.theregister.com/