PhantomRaven Strikes Again: 88 Malicious npm Packages Found

What Happened

Imagine finding out that a hacker group is back, targeting developers through popular software tools. This is exactly what's happening with the return of the PhantomRaven supply-chain campaign, which has resurfaced with 88 new malicious packages on npm^?. Security researchers from Endor Labs uncovered these packages, published between November 2025 and February 2026, with 81 still available for download. Alarmingly, two active command and control (c2) servers^? are also linked to these packages.

PhantomRaven uses a clever trick called Remote Dynamic Dependencies (RDD)^? to hide its malicious code. Instead of embedding the malware directly in the package, attackers link to an external URL in the package's configuration file. When developers install the package, they unknowingly download the harmful code from the attacker's server, bypassing traditional security checks. This method is particularly dangerous because it allows the malware to steal sensitive information like email addresses, system details, and credentials from popular CI/CD platforms^?.

Why Should You Care

You might think this only affects software developers, but the implications are much broader. If you're a developer, your projects could be compromised, potentially leading to data breaches that affect your company or clients. Even if you’re not a developer, the software you use could be built on these compromised packages, putting your personal data at risk.

The key takeaway here is that malicious packages can sneak into your development environment without you even realizing it. Just like a Trojan horse, they appear harmless but can unleash chaos once inside. This situation highlights the importance of being vigilant about the software you install and the sources you trust.

What's Being Done

Security experts are actively monitoring the situation and have shared some immediate steps you can take:

• Avoid using any packages from unverified sources. Stick to well-known repositories.
• Regularly update your dependencies to ensure you have the latest security patches.
• Use security tools that can scan for vulnerabilities, even those that might be hidden through RDD techniques.

Experts are also keeping an eye on the evolving tactics of PhantomRaven, especially as they claim their packages are part of a legitimate research experiment. However, the presence of active command-and-control servers and data exfiltration^? routines strongly suggests otherwise. The cybersecurity community is on alert for any new developments or changes in the attackers' strategies.