The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks

The PhantomRaven campaign demonstrates how attackers are exploiting npm’s remote dynamic dependencies to stealthily harvest sensitive developer and CI/CD data across multiple waves, evading traditional detection by shifting infrastructure and relying on benign-looking packages that fetch malicious payloads at install time.