The report
# PhantomRaven: the npm campaign that hid malware behind remote dependencies
PhantomRaven did not need a spectacular exploit. It used a more ordinary weakness in software development: developers install packages, package managers resolve dependencies, and build systems often trust what arrives next.
The campaign was first traced by Koi Security to August 2025. By late October, Koi had identified 126 malicious npm packages with more than 86,000 downloads. Sonatype then reported 83 additional packages, pushing the known set above 200. Endor Labs later documented another 88 packages across three subsequent waves extending into February 2026.
Those numbers describe package and download volume. They do not establish the number of compromised people, hosts, or organizations.
The trick was outside the visible package
The central technique was a remote dependency.
A developer could install a package that looked small or relatively ordinary. Its package manifest then pointed npm to an attacker-controlled HTTP URL. npm fetched a second-stage package from that remote location, and an install-time lifecycle script could execute JavaScript inside the developer or build environment.
That split mattered. The registry-hosted package was not the whole payload. The remotely fetched dependency could change without the outer package receiving a new release, leaving static inspection of the first package with an incomplete picture.
CrowdStrike described the PhantomRaven stealer as collecting host and developer-environment information, including Git and npm configuration data, package metadata, and CI/CD-related environment variables that could contain authentication tokens or API keys. The collected data was then sent to attacker-controlled infrastructure over HTTP.
This placed ordinary developer systems and automated build infrastructure in the same risk path: local workstations, GitHub Actions, GitLab CI, Jenkins, CircleCI, container builds, and other environments where package installation can see valuable credentials.
AI appears twice in the story
PhantomRaven has two separate AI-related elements, and they should not be merged into one claim.
The first is slopsquatting. Koi Security described packages with plausible names that could benefit from developers trusting names hallucinated or suggested by AI coding tools. This is a distribution opportunity: a model suggests a package that does not really exist, an attacker has already registered the name, and the developer installs it.
The second is the malware itself. In September 2026, CrowdStrike assessed with high confidence that the PhantomRaven JavaScript stealer was likely developed using a large language model. Its assessment cited characteristics including unusually verbose comments, placeholder code, redundant implementation choices, and statistical token-analysis patterns.
That is still an assessment, not direct model provenance. No reviewed source provides model logs, a named model provider, or another direct record showing exactly which model produced the code.
One campaign, several waves
The available research shows a campaign that persisted rather than a single package incident.
Koi traced the activity to August 2025. Sonatype expanded the known package set at the end of October. Endor Labs then tracked later waves from November 2025 through February 2026, identifying 88 additional packages and more than 50 disposable npm accounts.
CrowdStrike separately reported that its Falcon Complete team responded to and remediated multiple PhantomRaven incidents. It also linked specific npm accounts and infrastructure to a self-described bug-bounty hunter.
The motive remains less certain than the technical activity.
CrowdStrike assessed that the operator likely used compromised data to identify bug-bounty opportunities rather than selling stealer logs. Endor Labs later reported that the package author contacted researchers and claimed the packages were intended to demonstrate software-supply-chain vulnerabilities for responsible disclosure or bug-bounty evidence.
Those statements provide context. They do not prove the operator's intent for every package or every compromise.
The exfiltration picture is not uniform
The campaign should also not be summarized as either "86,000 victims" or "no data was stolen."
The 86,000-plus figure reported by Koi was a download count. It does not tell us how many installations executed the second stage, how many environments exposed secrets, or how many organizations experienced downstream compromise.
At the other end, Endor Labs reported in March 2026 that no actual secrets or credentials appeared to have been exfiltrated in the later-wave packages it analyzed. It also observed that the remote payload used by those waves had been replaced with a minimal benign script, effectively neutralizing data harvesting across the studied set without changing the published outer packages.
That finding is important but scoped. CrowdStrike later documented multiple real incidents and described data-collection and exfiltration behavior. The public evidence still does not provide a campaign-wide victim count, a complete accounting of successful credential theft, or a quantified financial-loss total.
npm changed the default
The ecosystem eventually changed one of the conditions PhantomRaven relied on.
npm v12 became generally available on July 8, 2026 with stricter install-time defaults. Dependency lifecycle scripts and remote URL dependencies became opt-in rather than automatically trusted.
That does not make malicious packages disappear. It changes the default execution boundary.
For teams maintaining older npm versions or explicitly re-enabling install scripts and remote dependencies, the older risk model can still return. The useful defensive lesson is therefore broader than "upgrade npm":
- keep dependency lifecycle scripts disabled unless a package has a justified need;
- inspect package manifests and lockfiles for remote URL dependencies;
- treat unexpected package names, including AI-suggested names, as untrusted until provenance is verified;
- restrict package sources in sensitive development and CI/CD environments;
- monitor outbound network activity during dependency installation;
- rotate developer, npm, source-control, CI/CD, and API credentials after suspected exposure.
What remains unknown
Several questions are still open.
The public sources do not establish the total number of organizations on which PhantomRaven actually executed. They do not quantify financial loss. They do not show how many exposed credentials were successfully used. They do not establish how much, if any, bug-bounty revenue came specifically from PhantomRaven-enabled access.
They also do not provide direct provenance for the LLM-development assessment.
That uncertainty does not make the campaign hypothetical. It changes what can responsibly be claimed about its scale and motive.
PhantomRaven is useful because it joins several separate problems into one case: package-name deception, remote dependency resolution, install-time execution, CI/CD credential exposure, AI-assisted package discovery failure, and likely AI-assisted malware development.
The important boundary was not only the package developers thought they were installing. It was every remote action their tooling was still allowed to take after that choice.
Sources
- Koi Security - PhantomRaven: NPM Malware Hidden in Invisible Dependencies
- Sonatype - PhantomRaven: npm Malware Uses Remote Dynamic Dependencies
- Endor Labs - The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks
- GitHub - npm install-time security and GAT bypass2fa deprecation
- CrowdStrike - PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting