Loading story…
CrowdStrike identified PhantomRaven, a JavaScript information-stealer campaign attributed to a likely low-sophistication eCrime actor tracked as JPD. The actor distributed typosquatted npm packages that use HTTP-based remote dynamic dependencies: during installation, npm retrieves a malicious dependency whose preinstall script automatically executes the payload.
The stealer collects host and runtime details, Git and npm configuration, and CI/CD environment data that can expose developer credentials, then exfiltrates the information through HTTP GET and POST requests to attacker-controlled infrastructure. JPD may also be connected to PyPI-hosted stealer code and may have sought bug-bounty payouts using compromised data. npm 12 and later blocks dependency-install scripts by default unless explicitly approved, reducing exposure to this execution technique.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
A PhantomRaven campaign used techniques resembling the actor's claimed RCE method, using HTTP-hosted remote dependencies that retrieved a malicious package and executed its preinstall script during npm installation. The domain npm[.]jpartifacts[.]com was used for command-and-control activity.
The actor claimed to have obtained remote code execution by publishing a malicious npm package with a preinstall script; the claim was not independently verified.
The threat actor's GitHub account submitted an issue to PyPI concerning an unsuccessful package upload.
CrowdStrike associated the likely low-sophistication eCrime actor JPD with PhantomRaven deployments, citing linked npm identities, PyPI-hosted code, and infrastructure. It assessed with high confidence that the PhantomRaven code was almost certainly LLM-generated and with moderate confidence that the actor sought company access potentially to support bug-bounty reward claims.
A PyPI organization member accused the actor of attempting to build an information stealer and linked to the actor's main project, which was later removed from PyPI. Associated Python files remained accessible and contained stealer code similar to PhantomRaven.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported a renewed **PhantomRaven** software supply chain campaign on the npm registry involving **88 malicious packages** masquerading as trusted JavaScript ecosystem projects, including packages themed around *Babel* and *GraphQL Codegen*. The packages were published across three waves from late 2025 into early 2026 and were designed to automatically fetch and run malware after installation, targeting developers and build environments rather than end users. The activity is not fluff: it is a substantive threat intelligence and malware distribution story involving active credential theft through open-source package abuse. The malware exfiltrates sensitive data from developer systems and CI/CD environments, including emails and configuration data from `.npmrc`, `.gitconfig`, and environment variables, as well as tokens for **GitHub**, **GitLab**, **CircleCI**, and **Jenkins**. Reporting indicates PhantomRaven has kept core infrastructure and payload behavior broadly consistent since earlier activity, while adapting operational details by rotating npm and email accounts, changing package metadata and PHP endpoints, and increasing the pace of malicious package publication. Most of the packages were reportedly still available for download at the time of reporting, underscoring continued exposure for organizations that rely on npm-based development workflows.
Jun 29, 2026
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026