PhantomRaven, npm remote dynamic dependencies

What happened

• 126 packages, about 86k downloads. Dependencies pulled from an attacker URL, invisible to scanners. AI-hallucinated names (“slopsquatting”) used.

Sources

• https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.