Invisible npm malware pulls a disappearing act – then nicks your tokens

A new supply chain attack dubbed PhantomRaven has flooded the npm registry with malicious packages that steal credentials, tokens, and secrets during installation. The packages appear safe when first downloaded, making them particularly difficult for security apps to identify. According to researchers at Koi, the campaign has been active since at least August 2025 and involves 126 malicious packages published by multiple accounts. At least 86,000 downloads were recorded before the campaign was exposed this week, and more than 80 of the infected packages were still live at the time of disclosure. What sets PhantomRaven apart is its use of a new technique the researchers call Remote Dynamic Dependencies (RDD). Unlike typical npm malware, which relies on visible dependencies or post-install scripts, PhantomRaven packages initially appear empty – no dependencies, no suspicious code. But when a user installs them, the package fetches additional code from a remote server controlled by the attacker. The malicious payload is then executed locally, stealing data and exfiltrating it to the attacker's infrastructure. This makes the attack extremely difficult to detect using conventional methods. Security tools that rely on static analysis of package metadata or dependency graphs will see nothing out of the ordinary, because the harmful code doesn't exist in the registry itself. Instead, it's dynamically retrieved during installation, leaving no obvious trace in the source files. The sto...