Executive Summary
A fifth wave of the PhantomRaven campaign has been identified, targeting the NPM ecosystem with 33 new malicious packages aimed at developers in the DeFi, AI, and Cloud Infrastructure sectors. This persistent threat actor, active since August 2025, utilizes a sophisticated three-stage delivery chain to bypass static analysis and exfiltrate sensitive developer identity and CI/CD secrets.
The attack chain leverages 'Remote Dynamic Dependencies' where a benign-looking NPM package references a C2-hosted tarball as a dependency. This triggers an automated infection process during 'npm install' via lifecycle hooks. The campaign has demonstrated high resilience, registering new infrastructure only eight days after previous public disclosures.
This activity is high-risk for organizations using JavaScript/Node.js, as the final payload silently harvests environment variables, Git configurations, NPM credentials, and CI/CD metadata (GitHub Actions, GitLab CI, etc.). The potential for downstream supply chain compromise or production credential theft is significant.