PhantomRaven hid its credential stealer in an npm dependency that scanners never fetch

Koi Security says the HTTP dependency is re-fetched from the attacker's host on every `npm install`, uncached, unversioned and unrecorded in any lockfile ^[12]. So the contents behind that URL can change between installs while the manifest stays identical, and last week's build and today's can run different code.

Behaviour is what caught this one. Koi's Wings engine flagged packages making outbound requests to one domain during installation, in October 2025 ^[8]. Static review of the published package finds a hello world script and nothing else ^[4]. npmjs.com leaves HTTP dependency specifiers unresolved and scanners walk past them, so the registry page reports 0 Dependencies ^[6].

More than 86,000 installs across 126 packages averages about 683 per package ^[15]. The published timeline dates 101 of them: 21 removed by npm in August 2025, and 80 uploaded across September and October that got through ^[9][10][16]. That leaves 25 undated. Eighty were still live when Koi published, 63 percent of the set ^[11][17].

What Koi observed is install-time traffic to a single domain and credential collection; the company wrote that the packages were "actively stealing npm tokens, GitHub credentials, and CI/CD secrets from developers worldwide" ^[8][3]. Koi offers the selective-serving scenario as theory: check the requesting IP, return benign code to researchers on VPNs and the payload to corporate networks, or serve clean code for weeks to pass scans and flip later ^[18].

npm runs the code on its own. The fetched package declares a `preinstall` hook that runs `node index.js`, and npm executes it automatically, unprompted and with no user interaction ^[13]. It works the same at depth: a package three levels down the tree still runs its preinstall on the machine doing the install ^[14].

Two controls sit on that chain. Egress filtering on build runners breaks the fetch from `packages.storeartifact.com` ^[5][12]. Refusing to run lifecycle scripts at install breaks the execution step ^[13]. Dependency-tree analysis reads an empty tree and sits outside the chain ^[6].

The operator was careless about identity. Koi lists sequential free-mail accounts from jpdtester01@hotmail.com through jpdtester13@gmail.com, and registry usernames including npmhell and npmpackagejpd ^[7]. The delivery technique kept working through 80 further uploads after npm took down the first 21 ^[9][10].