PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs

PhantomRaven has been identified as a software supply chain attack targeting the npm registry, with security researchers naming the campaign PhantomRaven and attributing it to a threat actor tracked by Koi Security. The activity began in August 2025 and has since grown to 126 npm libraries, amassing more than 86,000 installs.

Several of the malicious packages—op-cli-installer, unused-imports, badgekit-api-client, polyfill-corejs3 and eslint-comments—are used to pull in remote dynamic dependencies from an attacker‑controlled URL (packages.storeartifact[.]com) rather than npmjs[.]com, enabling the attacker to tailor payloads and deploy more stealthy malware as adoption grows.

The attack chain starts when a benign package is installed, triggering the remote dependency and a pre-install hook that runs the main payload, which then attempts to exfiltrate environment details such as email addresses, CI/CD information and the system’s public IP.

Oren Yomtov, in a report shared with The Hacker News, highlighted that security scanners often miss such Remote Dynamic Dependencies, and that the attacker‑controlled URL can be used to change payloads over time, a tactic the DCODX group has also noted as slopsquatting. According to The Hacker News, this case demonstrates how attackers exploit blind spots in security tooling to weaponise open‑source ecosystems.