The npm package 'transform-regexp-constructors' is part of the PhantomRaven supply chain attack campaign. It uses a Remote Dynamic Dependency technique to fetch and execute a malicious payload during installation. This payload harvests developer emails, CI/CD tokens, and fingerprints the host system, exfiltrating data to an attacker-controlled server. Developers and CI/CD systems that installed this package should consider their environments compromised and rotate all accessible secrets and credentials immediately.