MAL-2026-3125

Dashboard / Malicious Package / MAL-2026-3125

MAL-2026-3125

Summary: Malicious code in transform-regexp-constructors (npm)

Details: The package 'transform-regexp-constructors' is part of the PhantomRaven supply chain attack campaign (Wave 3). It uses a Remote Dynamic Dependency (RDD) technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server (package.storeartifacts.com). During npm install, npm automatically fetches a malicious tarball from the C2. The tarball preinstall hook executes a 259-line payload that harvests developer emails from .gitconfig, .npmrc, and environment variables; collects CI/CD tokens from GitHub Actions, GitLab CI, Jenkins, and CircleCI; fingerprints the host system; and exfiltrates all data to http://package.storeartifacts.com/npm.php via redundant HTTP GET, POST, and WebSocket channels with no visible terminal output. The campaign was first disclosed by Koi Security in October 2025 (Wave 1) and extended across Waves 2-4 between November 2025 and February 2026. Full analysis: https://www.endorlabs.com/learn/return-of-phantomraven Any developer or CI/CD system that installed this package should be considered compromised. All secrets, tokens, and credentials accessible from that environment should be rotated immediately from a separate, unaffected machine. Source: amazon-inspector (fe9ae291eb7b64a00eab5a184806e56e7451b7b0d7cad6ef42a2f22f6ec8070d) The package transform-regexp-constructors was found to contain malicious code.

References: https://www.endorlabs.com/learn/return-of-phantomraven, https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-dependencies