Published 3:00 p.m. ET on October 31, 2025; last updated 5:00 p.m. ET on October 31, 2025

This week, an open source malware campaign dubbed ‘PhantomRaven’ has run rampant, flooding the npm registry with over a hundred malicious packages that saw more than 86,000 potential victims before discovery.

Unlike previous waves of typosquatting or credential-theft attacks, PhantomRaven introduces a new evasion tactic: remote dynamic dependencies, a mechanism that fetches malicious payloads from outside the npm registry, effectively masking the true dependency tree.

Sonatype, alongside other security research firms, has tracked this malicious campaign and continued to analyze indicators of compromise (IoCs) and tactics, techniques and procedures (TTPs) of the threat actors. Sonatype Security Research has uncovered 83 additional packages associated with this campaign, now reaching more than 200 total. These packages are brandjacking organizations like Adobe and AirBNB or pretending to be MCP servers.

Analysis of the ‘petstore-integration-test’ package demonstrated how the attackers evolved tactics over time in order to improve stealth and evade detection. In version 1.0.0, the threat actors used an earlier version of the PhantomRaven campaign’s malware which did not contain remote dynamic dependencies. Over time, however, two additional versions of ‘petstore-integration-test’ were published (1.0.3 and 99.0.0) that used the more advanced evasion techniques described.

The full list of malicious packages associated with the PhantomRaven campaign is included at the bottom of this blog post.

A Campaign Hidden Beneath Zero Dependencies

The campaign, first detailed by researchers at Koi, appeared to begin in August 2025 and relied on dozens of seemingly benign npm packages. Each package advertised “zero dependencies,” giving developers and scanners a false sense of safety. Underneath, however, they contained URL-based imports pointing to attacker-controlled servers.

This meant that there was no actual malicious code in the packages themselves. Instead, (Read more...)