PhantomRaven malicious npm package waves
Malware Activity
Summary
Hide ▲
Show ▼
The PhantomRaven malware operation is still pushing malicious npm packages into the npm registry, keeping the risk of developer-machine compromise and data theft active. The packages use Remote Dynamic Dependencies (RDD) to pull code from attacker-controlled URLs at install time, which helps them bypass automated inspection. Once a developer runs npm install, the payload can execute, collect sensitive data, and exfiltrate it to attacker infrastructure. The activity has shown repeated waves from August 2025 through February 2026.
Related Happenings
Npm v12 default-blocks install scripts, Git dependencies, and remote URLs
Security Tool/Service
H score11
First: 12.06.2026 16:00
Last: 12.06.2026 16:00
Sources 1
About this happening:
GitHub announced **npm v12** with **default-blocking install scripts, Git dependencies, and remote URLs**, shifting package installation to **explicit opt-in** and reducing **supp...
Npm v12 default-blocks install scripts, Git dependencies, and remote URLs
Security Tool/ServiceAbout this happening: GitHub announced **npm v12** with **default-blocking install scripts, Git dependencies, and remote URLs**, shifting package installation to **explicit opt-in** and reducing **supp...
TrapDoor trap-core.js credential-stealing package malware
Malware Activity
H score34
First: 25.05.2026 08:59
Last: 25.05.2026 08:59
Sources 1
About this happening:
The **TrapDoor** package malware is spreading across **npm, PyPI, and Crates.io**, putting **developer secrets, cloud credentials, SSH keys, and crypto wallets** at risk. The malw...
TrapDoor trap-core.js credential-stealing package malware
Malware ActivityAbout this happening: The **TrapDoor** package malware is spreading across **npm, PyPI, and Crates.io**, putting **developer secrets, cloud credentials, SSH keys, and crypto wallets** at risk. The malw...
TrapDoor cross-ecosystem supply-chain campaign
Campaign
H score38
First: 25.05.2026 08:59
Last: 25.05.2026 08:59
Sources 1
About this happening:
The **TrapDoor** supply-chain campaign has expanded across **npm, PyPI, and Crates.io**, using **34+ malicious packages** to steal developer secrets and credentials. The operation...
TrapDoor cross-ecosystem supply-chain campaign
CampaignAbout this happening: The **TrapDoor** supply-chain campaign has expanded across **npm, PyPI, and Crates.io**, using **34+ malicious packages** to steal developer secrets and credentials. The operation...
Shai-Hulud worm clone activity on NPM
Malware Activity
H score69
First: 18.05.2026 12:45
Last: 18.05.2026 12:45
Sources 1
About this happening:
The **Shai-Hulud** malware activity has continued to evolve across the **npm supply chain** and related developer ecosystems. It first infected **npm packages** in **September 202...
Shai-Hulud worm clone activity on NPM
Malware ActivityAbout this happening: The **Shai-Hulud** malware activity has continued to evolve across the **npm supply chain** and related developer ecosystems. It first infected **npm packages** in **September 202...
Deadcode09284814 malicious npm packages delivering Phantom Bot and infostealers
Malware Activity
H score22
First: 18.05.2026 11:57
Last: 18.05.2026 11:57
Sources 1
About this happening:
Four **npm** packages published by **deadcode09284814** were found delivering **information-stealing malware** and **Phantom Bot** DDoS capability, putting installers at risk of *...
Deadcode09284814 malicious npm packages delivering Phantom Bot and infostealers
Malware ActivityAbout this happening: Four **npm** packages published by **deadcode09284814** were found delivering **information-stealing malware** and **Phantom Bot** DDoS capability, putting installers at risk of *...
Timeline
-
11.03.2026 19:09 1 articles · 4mo ago
PhantomRaven adds four malicious npm packages on February 18
Campaign Scope UpdatePhantomRaven expanded its npm activity on February 18, 2026 by adding four malicious packages in a single day, extending the campaign's repeated waves against the npm registry and JavaScript developer machines.
Show sources
- New PhantomRaven NPM attack wave steals dev data via 88 packages — www.bleepingcomputer.com — 11.03.2026 19:09
-
11.03.2026 19:09 3 articles · 4mo ago
Endor Labs discloses new PhantomRaven npm waves
Initial DisclosureEndor Labs reported new PhantomRaven supply-chain waves targeting the npm registry, saying attackers used Remote Dynamic Dependencies (RDD) in package.json to pull code from an external URL at install time, operated through 50 disposable accounts, and distributed 88 malicious packages between November 2025 and February 2026. The malware collects emails from .gitconfig, .npmrc, and environment variables, targets CI/CD tokens from GitHub, GitLab, Jenkins, and CircleCI, fingerprints the host with IP, hostname, operating system, and Node version, and exfiltrates stolen data to attacker C2 infrastructure hosted on Amazon Elastic Compute Cloud (EC2).
Show sources
- New PhantomRaven NPM attack wave steals dev data via 88 packages — www.bleepingcomputer.com — 11.03.2026 19:09
- New PhantomRaven NPM attack wave steals dev data via 88 packages — www.bleepingcomputer.com — 11.03.2026 19:09
- PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs — thehackernews.com — 30.10.2025 12:16