This threat is a fifth wave of the PhantomRaven NPM supply chain attack campaign involving 33 newly identified malicious packages. The attack uses a sophisticated three-stage payload delivery that employs Remote Dynamic Dependency techniques to bypass static analysis tools. The malicious packages self-reference dependencies pointing to attacker-controlled domains (pack.nppacks.com), which deliver droppers designed to harvest developer credentials, system information, CI/CD tokens, GitHub repository names, and email addresses from Git and NPM configurations and environment variables. The stolen data is exfiltrated to a PHP endpoint (mozbra.php) on the command-and-control server. The campaign specifically targets developers in DeFi cryptocurrency, Azure cloud infrastructure, and AI application domains. Infrastructure analysis reveals connections to a legitimate Pakistani IT services company domain, suggesting potential compromise or misuse. There is no known patch or official fix available, and no known exploits in the wild have been reported.

The campaign enables attackers to harvest sensitive developer credentials, system information, CI/CD tokens, GitHub repository names, and email addresses, potentially leading to further compromise of development environments, source code repositories, and cloud infrastructure. This can facilitate unauthorized access, code manipulation, and data exfiltration in targeted sectors such as DeFi, cloud, and AI development. The use of Remote Dynamic Dependency techniques allows the attack to evade static analysis detection, increasing the risk of undetected compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, organizations should monitor for updates from trusted sources and consider auditing their NPM dependencies for suspicious packages, especially those referencing pack.nppacks.com or related domains. Developers should verify the integrity of packages before use and avoid installing undocumented or untrusted NPM packages. Employing runtime monitoring for unusual network activity to domains like pack.nppacks.com and hblnew.ecompk.com may help detect exploitation attempts. No vendor advisory indicates 'no action required' or 'already mitigated,' so proactive defensive measures are recommended.