Indicators of Compromise

Domain

TLP:CLEAR

pkg.author.email

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/npm/graphql-js-client-transform

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/npm/idle-style-xi

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/npm/local-rules

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/route.js

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/token.php

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

Domain

TLP:CLEAR

ecompk.com

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

Domain

TLP:CLEAR

hblv2.ecompk.com

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/mozbra.php

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://pack.nppacks.com/npm/

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

MD5 Hash

TLP:CLEAR

4bdb7aef96dc04c250cceefa222d7d1a

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

SHA-1 Hash

TLP:CLEAR

83088e7cb00cf9fab74df2f64b7021b2deef6610

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

SHA-256 Hash

TLP:CLEAR

0ce9b82d290004031b7cc49d724c00011811e1753a283a93a380a311360cfb66

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

SHA-256 Hash

TLP:CLEAR

78937711bbc74542d304c7a7ea451465a2342438116fb37aa715ccf89b027d04

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

SHA-256 Hash

TLP:CLEAR

abe9ee9edfc44f7675400207a826c260b2f197d1f93e36010c35d627983e4294

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

URL

TLP:CLEAR

http://hblnew.ecompk.com/npm/local-rules

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

Domain

TLP:CLEAR

console.info

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

75% confidence

Added

2026-05-06

Domain

TLP:CLEAR

pack.nppacks.com

ThreatFox: Unknown malware

40% confidence

Added

2026-05-03

Domain

TLP:CLEAR

hblnew.ecompk.com

ThreatFox: Unknown malware

40% confidence

Added

2026-05-03