NEW PHANTOMRAVEN NPM ATTACK WAVE STEALS DEV DATA VIA 88 PACKAGES

Summary from the TLDR InfoSec newsletter

PhantomRaven, an ongoing npm supply-chain campaign active since August 2025, has deployed 88 additional malicious packages across four attack waves, using slopsquatting to mimic projects like Babel and GraphQL Codegen with LLM-suggested package names. The campaign evades automated inspection via Remote Dynamic Dependencies (RDD), in which `package.json` points its dependencies to attacker-controlled external URLs, pulling and executing malware at `npm install` time rather than embedding it in the package itself. The payload harvests `.gitconfig`, `.npmrc`, environment variables, and CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI before exfiltrating to EC2-hosted C2 infrastructure, with 81 packages still live in the registry as of this writing.