PhantomRaven: the npm campaign that hid malware behind remote dependencies

PhantomRaven did not need a spectacular exploit. It used a more ordinary weakness in software development: developers install packages, package managers resolve dependencies, and build systems often trust what arrives next.

The campaign was first traced by Koi Security to August 2025. By late October, Koi had identified 126 malicious npm packages with more than 86,000 downloads. Sonatype then reported 83 additional packages, pushing the known set above 200. Endor Labs later documented another 88 packages across three subsequent waves extending into February 2026.

Those numbers describe package and download volume. They do not establish the number of compromised people, hosts, or organizations.

The central technique was a remote dependency.

A developer could install a package that looked small or relatively ordinary. Its package manifest then pointed npm to an attacker-controlled HTTP URL. npm fetched a second-stage package from that remote location, and an install-time lifecycle script could execute JavaScript inside the developer or build environment.

That split mattered. The registry-hosted package was not the whole payload. The remotely fetched dependency could change without the outer package receiving a new release, leaving static inspection of the first package with an incomplete picture.

CrowdStrike described the PhantomRaven stealer as collecting host and developer-environment information, including Git and npm configuration data, package metadata, and CI/CD-related environment variables that could contain authentication tokens or API keys. The collected data was then sent to attacker-controlled infrastructure over HTTP.

This placed ordinary developer systems and automated build infrastructure in the same risk path: local workstations, GitHub Actions, GitLab CI, Jenkins, CircleCI, container builds, and other environments where package installation can see valuable credentials.

In September 2026, CrowdStrike assessed with high confidence that the PhantomRaven JavaScript stealer was likely developed using a large language model. It cited verbose comments, placeholder code and statistical token patterns. The report does not provide model logs or identify a provider, so this remains an attributed assessment.

AI assistance in discovering a package is a separate question. Deceptive package names could attract an AI coding tool or a developer, but the accessible reports do not document a model inventing a PhantomRaven name, recommending it to a victim or causing its installation. That gap prevents classifying the observed distribution as proven slopsquatting.

The package attack evidence article compares this gap with the defensively registered react-codeshift name and controlled HalluSquatting research. Those studies establish different parts of the resolution chain; they do not supply missing victim evidence for PhantomRaven.

The available research shows a campaign that persisted rather than a single package incident.

Koi traced the activity to August 2025. Sonatype expanded the known package set at the end of October. Endor Labs then tracked later waves from November 2025 through February 2026, identifying 88 additional packages and more than 50 disposable npm accounts.

CrowdStrike separately reported that its Falcon Complete team responded to and remediated multiple PhantomRaven incidents. It also linked specific npm accounts and infrastructure to a self-described bug-bounty hunter.

The motive remains less certain than the technical activity.

CrowdStrike assessed that the operator likely used compromised data to identify bug-bounty opportunities rather than selling stealer logs. In its March 17, 2026 update, Endor Labs had separately reported that the package author claimed a responsible disclosure or bug bounty purpose. That author response preceded the September CrowdStrike report.

Those statements provide context. They do not prove the operator's intent for every package or every compromise.

The campaign should also not be summarized as either "86,000 victims" or "no data was stolen."

The 86,000-plus figure reported by Koi was a download count. It does not tell us how many installations executed the second stage, how many environments exposed secrets, or how many organizations experienced downstream compromise.

At the other end, Endor Labs reported in March 2026 that no actual secrets or credentials appeared to have been exfiltrated in the later-wave packages it analyzed. It also observed that the remote payload used by those waves had been replaced with a minimal benign script, effectively neutralizing data harvesting across the studied set without changing the published outer packages.

That finding is important but scoped. CrowdStrike later documented multiple real incidents and described data-collection and exfiltration behavior. The public evidence still does not provide a campaign-wide victim count, a complete accounting of successful credential theft, or a quantified financial-loss total.

The ecosystem eventually changed one of the conditions PhantomRaven relied on.

npm v12 became generally available on July 8, 2026 with stricter install-time defaults. Dependency lifecycle scripts and remote URL dependencies became opt-in rather than automatically trusted.

That does not make malicious packages disappear. It changes the default execution boundary.

For teams maintaining older npm versions or explicitly re-enabling install scripts and remote dependencies, the older risk model can still return. The useful defensive lesson is therefore broader than "upgrade npm":

• keep dependency lifecycle scripts disabled unless a package has a justified need;
• inspect package manifests and lockfiles for remote URL dependencies;
• treat unexpected package names, including AI-suggested names, as untrusted until provenance is verified;
• restrict package sources in sensitive development and CI/CD environments;
• monitor outbound network activity during dependency installation;
• rotate developer, npm, source-control, CI/CD, and API credentials after suspected exposure.

Several questions are still open.

The public sources do not establish the total number of organizations on which PhantomRaven actually executed. They do not quantify financial loss. They do not show how many exposed credentials were successfully used. They do not establish how much, if any, bug-bounty revenue came specifically from PhantomRaven-enabled access.

They also do not provide direct provenance for the LLM-development assessment.

That uncertainty does not make the campaign hypothetical. It changes what can responsibly be claimed about its scale and motive.

The PhantomRaven Case connects deceptive package names, remote dependency resolution, lifecycle execution and potential CI/CD credential exposure. Likely LLM authorship is a separate vendor assessment. An AI recommendation causing a victim installation remains unestablished.

The important boundary was not only the package developers thought they were installing. It was every remote action their tooling was still allowed to take after that choice.

• Koi Security - PhantomRaven: NPM Malware Hidden in Invisible Dependencies
• Sonatype - PhantomRaven: npm Malware Uses Remote Dynamic Dependencies
• Endor Labs - The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks
• GitHub - npm install-time security and GAT bypass2fa deprecation
• CrowdStrike - PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting