New attack waves from the ‘PhantomRaven’ supply-chain campaign are hitting the npm registry, with dozens of malicious packages that exfiltrate sensitive data from JavaScript developers. The campaign was initially uncovered in October 2025 by researchers at cybersecurity company Koi, who said that it had been running since August and published 126 malicious packages on the npm platform. Application security company Endor Labs found three additional waves of the PhantomRaven attack that occurred between November 2025 and February 2026 and distributed 88 packages via 50 disposable accounts. In most cases, the threat actor used 'slopsquatting' to mimic established projects like Babel and GraphQL Codegen. They published malicious packages under names that appear suggested by large-language…