New PhantomRaven NPM attack wave steals dev data via 88 packages

PhantomRaven campaign uses Remote Dynamic Dependencies (RDD) evasion technique where package.json specifies dependencies at external URLs to avoid embedding malicious code directly. When developers run 'npm install', malware is automatically downloaded from attacker's server and executed. The attack uses 'slopsquatting' to mimic established projects like Babel and GraphQL Codegen with names appearing to be suggested by LLMs. Malware collects sensitive data including emails from .gitconfig, .npmrc, environment variables, and CI/CD tokens from GitHub, GitLab, Jenkins, CircleCI. System fingerprinting captures IP, hostname, OS, and Node version. Data exfiltration occurs via HTTP GET/POST requests and WebSocket to C2 servers. Infrastructure uses domains containing 'artifact' hosted on Amazon EC2 without TLS certificates. Payload remained nearly identical across waves with 257 of 259 code lines unchanged.