PhantomRaven is an eCrime threat actor identified for deploying malicious npm packages to conduct supply chain attacks. By utilizing typosquatted package names and remote dynamic dependencies, the actor installs a JavaScript-based information stealer. Recent campaigns have targeted developer environments, focusing on the exfiltration of sensitive CI/CD environment variables from platforms like GitHub Actions, GitLab, and Jenkins, alongside general system metadata.
Technical analysis indicates the malware is highly likely generated by Large Language Models (LLMs), as evidenced by verbose commenting and redundant code logic. The threat actor exploits npm's preinstall script feature to automate execution upon package installation. Security professionals are advised to update to npm version 12 or later, which implements restrictions on automatic script execution, and to monitor for connections to suspicious domains such as npm[.]jpartifacts[.]com.
Top comments (0)