Frequency
1
occurrences
First Seen
October 29, 2025
Last Seen
October 29, 2025
Related Threat Clusters
-
PhantomRaven Malware Campaign Targets npm Packages
A malware campaign named PhantomRaven has been active since August 2025, compromising 126 npm packages and stealing developer credentials, including npm tokens and GitHub credentials. Researchers at Koi Security…
8 articles · Updated November 15, 2025 -
PhantomRaven Malware Targets npm with 126 Credential-Stealing Packages
Researchers at Koi Security discovered a malware campaign named PhantomRaven that has been active since August 2025, compromising 126 npm packages. The malicious packages have been downloaded over 86,000 times and are…
4 articles · Updated October 31, 2025
Recent Intelligence Reports
- Npm Malware Uses Invisible Dependencies to Infect Dozens of Packages — Infosecurity-Magazine · October 29, 2025