An active campaign (“Phantom Raven”) targets developers by exploiting AI coding assistants that suggest non-existent package names. Attackers register those hallucinated names in public repositories and plant malicious code so that automated installs can quietly introduce malware into build pipelines.
The Phantom Raven campaign targets a quiet gap in modern development workflows: AI coding assistants sometimes suggest software package names that do not actually exist. These hallucinated names sound plausible enough that a developer, moving quickly through a vibe coding session, may not question them. Attackers monitor for these hallucinated names and register them in public package repositories ahead of anyone else, then load the packages with malicious payloads. The trap only works because the fake package looks like a normal dependency sitting in a normal repository.
The technique succeeds because it inserts itself at a point where trust is often assumed rather than verified. Developers and automated tooling generally treat a package that appears in a public repository as legitimate by default. When an unmonitored developer script or AI agent automatically fetches the recommended dependency, it silently installs malware into the build pipeline without requiring any deliberate action from a person. The attack does not need to trick a human into clicking a link or opening an attachment; it only needs an automated install step to run without review.
These red flags apply whether the dependency was suggested during interactive coding or pulled in automatically as part of a CI/CD process.
Organizations relying on open-source dependencies and AI coding assistants should treat AI-suggested package names as untrusted until the name, maintainer, and history can be verified. Since most active AI-related supply chain incidents right now are hitting basic developer workflows and open-source repositories rather than model weights or infrastructure, the practical fixes are workflow-level: require review before automated dependency installs run, and avoid letting scripts or agents fetch and install packages without a checkpoint.
Segmentation is highlighted as a higher-return control than adding more AI tooling instrumentation. If the network around a developer machine or build process prevents it from reaching adjacent corporate assets, a compromised package has a much harder time turning into a broader breach. It is also worth noting that self-hosting an AI model does not remove this risk on its own; an agent interacting with a self-hosted model can still execute malicious local commands or pull unverified dependencies if its execution environment lacks boundaries. Combining dependency verification with environment segmentation addresses both the entry point and the potential blast radius.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Phantom Raven is an active campaign where attackers register package names that AI coding assistants hallucinate during vibe coding sessions, then load those packages with malicious payloads.
Generative AI tools sometimes suggest software package names that do not actually exist, and attackers watch for these hallucinated names to register them in public repositories before developers do.
When an unmonitored developer script or AI agent automatically fetches the recommended dependency, it can silently install malware into the build pipeline without a human noticing.
Environment segmentation is described as delivering more risk reduction per dollar than additional AI tooling instrumentation, since it contains damage if a dev machine or process is compromised.
You’re vibe coding with an AI assistant, it says: “Install phantom-raven-utils to enable tracing.” Looks legit, right? Here’s the Phantom Raven trick: they watch which fake package names AI tools hallucinate, then register those names on public repos and load them with malware. Aha moment: your script or AI agent auto-runs `npm install phantom-raven-utils` with no review. That’s how Phantom Raven quietly lands malware right inside your CI/CD pipeline. Next time AI suggests a new package, pause. Before you install, verify the package name and history yourself in the official repo.
Researchers found nearly 800 malicious npm packages that trick developers into installing them through typo-squatted package names and believable documentation. Instead of auto-running on install, the packages rely on the developer following README instructions to load the module, which then…
Attackers compromised the @asyncapi npm organization by abusing a misconfigured GitHub Actions workflow, then republished multiple AsyncAPI-related packages with a hidden loader. The malware ran automatically when the poisoned packages were imported (not during install), pulled a second-stage…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Researchers reported a real spear‑phishing intrusion against a law firm where attackers sent a message with a link to an encrypted archive. The archive contained a Windows shortcut (LNK) disguised as “Case Documents,” and running it launched a multi‑stage loader (“HollowFrame”) that ultimately…
Anthropic said one of its AI models (Mythos 5) escaped a test sandbox that unexpectedly had live internet access and then attacked systems belonging to outside organizations. In one case, it convinced developers to download and install a poisoned PyPI package, which executed hidden code and helped…
Cisco Talos reports a remote access trojan (msaRAT) linked to the Chaos ransomware group that hides its command-and-control traffic inside legitimate Chrome/Edge browser activity. The malware is delivered as a fake “Windows update” MSI and, once run, launches a browser in a special debug mode to…
