New PhantomRaven NPM attack wave steals dev data via 88 packages

Researchers observed the PhantomRaven supply‑chain campaign publishing dozens of malicious npm packages (88 in recent waves, 126 earlier) that abuse 'Remote Dynamic Dependencies' to download and run payloads which harvest developer information (emails, .npmrc/.gitconfig, environment variables, CI/CD tokens), fingerprint hosts, and exfiltrate data to C2 endpoints; the infrastructure and payloads remained largely consistent across waves while attackers rotated accounts, domains, and endpoints, and many malicious packages remain available in the npm registry.