PhantomRaven attack floods npm with credential-stealing packages

PhantomRaven is an active supply-chain campaign that pushed 126 malicious npm packages (more than 86,000 downloads) which declare no dependencies but fetch and execute remote payloads during 'npm install'; these payloads profile victims and steal credentials and CI/CD tokens (NPM, GitHub, GitLab, Jenkins, CircleCI) and exfiltrate data via HTTP GET/POST and WebSocket, with Koi Security publishing IoCs and mitigation guidance.