PhantomRaven returns, harvesting credentials from developer environments

Endor Labs reports that the PhantomRaven campaign has returned to the npm ecosystem with malware hidden in packages that appear legitimate. The packages fetch additional payloads from attacker-controlled servers during installation, keeping the malicious functionality out of view for traditional dependency scanning. Once installed, the malware searches for GitHub tokens, CI/CD credentials and environment variables and exfiltrates them. The technique relies on remote dynamic dependencies, where code is loaded from external sources rather than the npm registry.

What this means for your business

What gets stolen here are keys to the build chain, not just data from one machine. With CI/CD credentials an attacker can alter what you actually ship to customers, at which point you become the link that spreads the risk onward. For organisations under NIS2, this is precisely the supply chain risk the regulation asks the board to have oversight of.

Berigo recommends

• Run package installation without network access beyond your approved registry, and block install-time scripts where feasible.
• Give build jobs short-lived, least-privilege tokens rather than static keys with broad access.
• Monitor outbound connections from build servers. They rarely have legitimate reason to contact unknown hosts.
• Establish a routine for rapid rotation of all CI/CD secrets, and test that it can genuinely be completed in a day.

Source

• endorlabs.com