Supply-chain compromise affecting an organization

A threat actor distributed PhantomRaven, a JavaScript-based information stealer, via the npm package registry. The developer likely used an LLM to write the malware, assessed with high confidence based on code patterns and comments.

Sources

• No primary source yet. This entry stays anonymized until one exists.
• Upstream: Security news (RSS + Claude). The upstream record names the organization, so it is not linked here.
• Candidate incidents extracted from public security reporting; every entry links its article