iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
SecurityWeek reported on October 30, 2025, that two malicious npm operations involved 136 packages with roughly 100,000 combined downloads over the preceding four months. One used install scripts to launch a downloaded payload; the other, dubbed PhantomRaven, fetched hidden remote dependencies during installation. Those are historical reported figures—not a current npm registry count, a count of confirmed infections, or proof that every download resulted in stolen data.
What the October 2025 report found
SecurityWeek attributed the activity to two operations that had been active since July and August 2025. Its figures describe package downloads reported at the time, not unique users or compromised systems. The article also said roughly 80 PhantomRaven packages remained active after about two dozen had been removed; that, too, is a snapshot from October 2025, not a statement about their current availability. SecurityWeek’s report
| Operation | Reported packages and downloads | Delivery and concealment described |
|---|---|---|
| July operation | 10 packages; more than 9,900 downloads when Socket found them, according to SecurityWeek. | Packages used a postinstall hook to launch a script and download a separate payload. |
| PhantomRaven | 126 packages; more than 86,000 downloads, according to SecurityWeek. | Remote dynamic dependencies and a preinstall hook fetched code at install time, potentially leaving the visible package archive without all the code that would run. |
The reported combined total was roughly 100,000 downloads. Neither that total nor either campaign’s individual figure establishes how many installations executed successfully, how many machines were infected, or whether targeted secrets were stolen.
Free tools Windows power users keep installed
One-click scans. No signup required.
How the packages could run code during installation
The July campaign: a postinstall script and downloaded payload
SecurityWeek said the July packages used npm’s postinstall hook, which runs a package script after installation when lifecycle scripts are enabled. In the reported chain, the script identified the operating system and launched a payload in a separate terminal window. That payload reportedly displayed a fake CAPTCHA, sent system information to a remote server, then downloaded and executed a final binary described as a 24 MB PyInstaller-packaged Python application.
#1 Best Overall
PhantomRaven: code fetched through a remote dependency
The report described PhantomRaven as abusing npm’s remote dynamic dependencies feature, which permits HTTP URLs as dependency specifiers. A preinstall hook fetched malicious code from a remote server during installation. SecurityWeek said the hook could run without a user prompt even when a package was nested in a dependency tree. As a result, inspecting only the package archive could miss code retrieved later from the network.
Typosquatting and plausible-looking names
SecurityWeek said both operations used typosquatting. The researchers’ explanation was that PhantomRaven chose names resembling plausible package names that AI assistants might hallucinate. That is an account of the naming strategy, not evidence that an AI recommendation caused any particular installation.
What the infostealers reportedly sought
The reporting described collection of system details and sensitive data from applications, databases, configuration files, and browsers. Named targets included keyrings, browser cookies, authentication tokens, SSH private keys, credentials, and other secrets.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesFor the July operation, collected information was reportedly compressed into ZIP files and sent to attacker-controlled infrastructure. PhantomRaven’s reported exfiltration methods included HTTP GET requests with data encoded in URLs, HTTP POST requests carrying JSON, and WebSocket connections. These describe the methods reported for the campaigns, not proof that every method was used successfully against every installation.
Rank #3
How to check a project and reduce exposure
Lumifi Cyber’s November 21, 2025 advisory recommends combining dependency review with controls over installation and build behavior. Its suggestions are defensive recommendations, not guarantees that a scan or control will detect every malicious package. Lumifi Cyber’s advisory
Review the dependency tree and package scripts
- Use
npm lsto inspect the installed dependency tree and identify unexpected packages or versions. - Use
npm auditand, where appropriate, a third-party scanner such as Snyk, Socket.dev, or Phylum. These tools can support review; the advisory does not establish comparative effectiveness. - Inspect package manifests for unfamiliar or unexpected
preinstallandpostinstallscripts. Also examine what those scripts invoke and whether they fetch or execute remote code. - Check names carefully for typosquatting and verify that package versions are the ones your project intends to use.
Constrain installation and build execution
- Pin and verify dependency versions, and restrict privileges available to package installation processes.
- Limit arbitrary outbound fetching from developer workstations and build hosts; investigate unexpected network connections during installs and builds.
- Run installs and builds in ephemeral, isolated CI containers rather than granting untrusted lifecycle scripts access to long-lived credentials or sensitive host resources.
- Use reproducible builds, signed artifacts, integrity checks, and SBOM validation to help detect unexpected changes to dependencies, archives, or binaries.
- Keep OS credential stores inaccessible to build processes where feasible, or use vaults that do not expose plaintext secrets.
SecurityWeek quoted DryRun Security CTO Ken Johnson urging teams to look beyond package selection and examine what happens after a dependency is pulled: install scripts, packaging, build artifacts, and runtime behavior. That distinction matters because a familiar-looking package name or a clean-looking archive alone cannot establish that installation is safe.
Rank #4
If an environment may have been exposed
Lumifi Cyber recommends rotating developer credentials, API tokens, and CI/CD secrets in environments that may have been affected. Prioritize secrets that were accessible to the installation or build process, and review relevant access and outbound-connection logs where available. The cited reporting does not identify confirmed victims, so exposure should be assessed from your own dependency history and environment evidence rather than inferred from download totals.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
