Bleepingcomputer

PhantomRaven Malware Campaign Targets npm Packages

First seen 2 Dec 2025, 18:33 UTC • Infosecurity-Magazine

+3 •26.4

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A malware campaign named PhantomRaven has been active since August 2025, compromising 126 npm packages and stealing developer credentials, including npm tokens and GitHub credentials. Researchers at Koi Security reported that over 86,000 downloads of these infected packages occurred, with many packages appearing safe to users initially, making detection difficult.

Ask AI about this cluster

Answers cite the sources they use

How this analysis works

Attack Flow

27 entities, 42 inferred relationships (STIX 2.1).

Threat Actor (1)

Unc6384

Technique (3)

Malware
Ransomware
Supply Chain Attack

Campaign (1)

PhantomRaven campaign

Organization (3)

Koi Security
Microsoft
Cursor

Indicator (2)

npmjs.com
npmscan.com

Malware (2)

PhantomRaven
PlugX

Affected Platform (9)

ChatGPT
Chromium
GitHub
Gitlab
Jenkins
Npm Registry
PyPI
Visual Studio Code
Windows

Tool (5)

GitHub Copilot
Node.js
Npm
AdaptixC2
NPM (Node Package Manager)

Vulnerability (1)

Unvalidated Redirect

Relationships

Unc6384 uses PhantomRaven
Unc6384 uses PlugX
Unc6384 uses GitHub Copilot
Unc6384 uses Node.js
Unc6384 uses Npm
Unc6384 uses AdaptixC2
Unc6384 uses NPM (Node Package Manager)
Unc6384 uses Malware
Unc6384 uses Ransomware
Unc6384 uses Supply Chain Attack
PhantomRaven exploits Unvalidated Redirect
PlugX exploits Unvalidated Redirect
GitHub Copilot exploits Unvalidated Redirect
Node.js exploits Unvalidated Redirect
Npm exploits Unvalidated Redirect
AdaptixC2 exploits Unvalidated Redirect
NPM (Node Package Manager) exploits Unvalidated Redirect
PhantomRaven communicates with npmjs.com
PhantomRaven communicates with npmscan.com
PlugX communicates with npmjs.com
PlugX communicates with npmscan.com
PhantomRaven campaign attributed to Unc6384
PhantomRaven campaign uses PhantomRaven
PhantomRaven campaign uses PlugX
Unvalidated Redirect targets ChatGPT
Unvalidated Redirect targets Chromium
Unvalidated Redirect targets GitHub
Unvalidated Redirect targets Gitlab
Unc6384 targets Koi Security
Unc6384 targets Microsoft
Unc6384 targets Cursor
PhantomRaven targets Koi Security
PhantomRaven targets Microsoft
PhantomRaven targets Cursor
PlugX targets Koi Security
PlugX targets Microsoft
PlugX targets Cursor
Unc6384 related to Jenkins
Unc6384 related to Npm Registry
Unc6384 related to PyPI
Unc6384 related to Visual Studio Code
Unc6384 related to Windows

Continue Reading

TA416 Resumes Cyber Espionage Against European Governments Amid Geopolitical Tensions Multiple Critical Windows Vulnerabilities Discovered and Exploited Chinese Hackers Exploit Windows Zero-Day to Target European Diplomats Chinese Hackers Exploit Windows Zero-Day to Target European Diplomats APT36's Ongoing Espionage Campaign Against Indian Government China-linked Hackers Target U.S. Non-Profit in Espionage Campaign

PhantomRaven Malware Campaign Targets npm Packages

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading