PhantomRaven malicious npm package waves
Malware Activity
Summary
Hide ▲
Show ▼
The PhantomRaven malware operation is still pushing malicious npm packages into the npm registry, keeping the risk of developer-machine compromise and data theft active. The packages use Remote Dynamic Dependencies (RDD) to pull code from attacker-controlled URLs at install time, which helps them bypass automated inspection. Once a developer runs npm install, the payload can execute, collect sensitive data, and exfiltrate it to attacker infrastructure. The activity has shown repeated waves from August 2025 through February 2026.
Related Happenings
TrapDoor trap-core.js credential-stealing package malware
Malware Activity
First: 25.05.2026 08:59
Last: 25.05.2026 08:59
Sources 1
About this happening:
The **TrapDoor** package malware is spreading across **npm, PyPI, and Crates.io**, putting **developer secrets, cloud credentials, SSH keys, and crypto wallets** at risk. The malw...
TrapDoor trap-core.js credential-stealing package malware
Malware ActivityAbout this happening: The **TrapDoor** package malware is spreading across **npm, PyPI, and Crates.io**, putting **developer secrets, cloud credentials, SSH keys, and crypto wallets** at risk. The malw...
TrapDoor cross-ecosystem supply-chain campaign
Campaign
First: 25.05.2026 08:59
Last: 25.05.2026 08:59
Sources 1
About this happening:
The **TrapDoor** supply-chain campaign has expanded across **npm, PyPI, and Crates.io**, using **34+ malicious packages** to steal developer secrets and credentials. The operation...
TrapDoor cross-ecosystem supply-chain campaign
CampaignAbout this happening: The **TrapDoor** supply-chain campaign has expanded across **npm, PyPI, and Crates.io**, using **34+ malicious packages** to steal developer secrets and credentials. The operation...
Shai-Hulud worm clone activity on NPM
Malware Activity
First: 18.05.2026 12:45
Last: 18.05.2026 12:45
Sources 1
About this happening:
The **Shai-Hulud** malware activity has continued to evolve across the **npm supply chain** and related developer ecosystems. It first infected **npm packages** in **September 202...
Shai-Hulud worm clone activity on NPM
Malware ActivityAbout this happening: The **Shai-Hulud** malware activity has continued to evolve across the **npm supply chain** and related developer ecosystems. It first infected **npm packages** in **September 202...
Deadcode09284814 malicious npm packages delivering Phantom Bot and infostealers
Malware Activity
First: 18.05.2026 11:57
Last: 18.05.2026 11:57
Sources 1
About this happening:
Four **npm** packages published by **deadcode09284814** were found delivering **information-stealing malware** and **Phantom Bot** DDoS capability, putting installers at risk of *...
Deadcode09284814 malicious npm packages delivering Phantom Bot and infostealers
Malware ActivityAbout this happening: Four **npm** packages published by **deadcode09284814** were found delivering **information-stealing malware** and **Phantom Bot** DDoS capability, putting installers at risk of *...
Mini Shai-Hulud supply-chain campaign targeting npm and PyPI
Campaign
First: 12.05.2026 17:45
Last: 12.05.2026 17:45
Sources 1
About this happening:
The **Mini Shai-Hulud** **supply-chain campaign** linked to **TeamPCP** expanded into downstream victim reporting, including **Grafana Labs**. Grafana said its **GitHub environmen...
Mini Shai-Hulud supply-chain campaign targeting npm and PyPI
CampaignAbout this happening: The **Mini Shai-Hulud** **supply-chain campaign** linked to **TeamPCP** expanded into downstream victim reporting, including **Grafana Labs**. Grafana said its **GitHub environmen...
Latest development: 21.05.2026 11:00
Grafana Labs said its GitHub environment was accessed and its codebase downloaded, with additional internal operational information taken from GitHub repositories, after compromise linked to the Mini Shai-Hulud campaign and TanStack npm packages. Grafana said it first spotted malicious activity on May 11, discovered the unauthorized download on May 17, and after contact from the ransom gang rotated automation tokens, enabled enhanced monitoring, audited commits since the May 11 incident, and hardened its GitHub security posture, while saying there is no indication customer production systems or operations were compromised.
Timeline
-
11.03.2026 19:09 1 articles · 2mo ago
PhantomRaven adds four malicious npm packages on February 18
Campaign Scope UpdatePhantomRaven expanded its npm activity on February 18, 2026 by adding four malicious packages in a single day, extending the campaign's repeated waves against the npm registry and JavaScript developer machines.
Show sources
- New PhantomRaven NPM attack wave steals dev data via 88 packages — www.bleepingcomputer.com — 11.03.2026 19:09
-
11.03.2026 19:09 3 articles · 2mo ago
Endor Labs discloses new PhantomRaven npm waves
Initial DisclosureEndor Labs reported new PhantomRaven supply-chain waves targeting the npm registry, saying attackers used Remote Dynamic Dependencies (RDD) in package.json to pull code from an external URL at install time, operated through 50 disposable accounts, and distributed 88 malicious packages between November 2025 and February 2026. The malware collects emails from .gitconfig, .npmrc, and environment variables, targets CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI, fingerprints the host with IP, hostname, operating system, and Node version, and exfiltrates stolen data to attacker C2 infrastructure hosted on Amazon Elastic Compute Cloud (EC2).
Show sources
- New PhantomRaven NPM attack wave steals dev data via 88 packages — www.bleepingcomputer.com — 11.03.2026 19:09
- New PhantomRaven NPM attack wave steals dev data via 88 packages — www.bleepingcomputer.com — 11.03.2026 19:09
- PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs — thehackernews.com — 30.10.2025 12:16