The PhantomRaven malware campaign targeting the npm supply chain has resurfaced with new waves of attacks, exploiting vulnerabilities in how dependencies are managed in npm packages.
Identified by Endor Labs, the new waves Wave 2, 3, and 4 were distributed between November 2025 and February 2026. While some malicious packages have been removed, many remain active, with 81 of 88 still available for download on npm.
This malware campaign continues to evolve, and at least two of the new command-and-control (C2) servers remain operational.
How PhantomRaven Works
PhantomRaven uses a sophisticated method known as Remote Dynamic Dependencies (RDD), allowing the malware to bypass traditional security scanning.
In a typical npm package, a package.json file lists the dependencies needed for the project. However, PhantomRaven tricks npm’s dependency resolution mechanism by specifying an HTTP URL instead of a typical version range.
This URL points to a malicious payload hosted on an attacker-controlled server, which npm fetches during a regular npm install command.
The packages published in Waves 2, 3, and 4 appear benign containing only a harmless “Hello World” script. However, when the package is installed, npm fetches the actual malicious payload, which is executed as part of the standard installation process.
The malicious code is housed within a tarball fetched from the attacker’s server, and it exfiltrates valuable developer data.
The malware targets emails, CI/CD tokens from platforms such as GitHub, GitLab, and Jenkins, and system information, including the developer’s public IP, hostname, and environment variables.
This process allows the attacker to collect credentials, tokenized access data, and other sensitive information without the developer’s knowledge.
.webp)
The payload uses a redundant exfiltration method data is first sent via HTTP GET requests, then via HTTP POST, and finally, if both fail, via WebSocket. This approach ensures that the data exfiltration is successful even in restrictive network environments.
Campaign Evolution and Indicators Of Compromise (IOCs)
The primary indicator of compromise (IOC) across all waves is the C2 domain and exfiltration endpoint. For instance, the PHP endpoint for data exfiltration consistently used names such as jpd.php across waves.
.webp)
These patterns, coupled with the consistent use of AWS-hosted infrastructure, provide strong indicators that the same actor is behind the entire campaign, despite changes in surface-level details.
PhantomRaven highlights the evolving nature of software supply chain attacks and the growing sophistication of methods used to bypass security controls.
By employing Remote Dynamic Dependencies (RDD), the malware makes it difficult for traditional security scanners to detect, as the malicious payload is never directly visible in the npm package itself.
To protect against these threats, developers and organizations should endorlabs adopt more advanced detection techniques that track external dependencies and monitor the infrastructure supporting them.
Regularly updating threat intelligence feeds and correlating attacker behavior across multiple waves will improve detection accuracy and help prevent future attacks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
