MSC-2026-4776

Multiple malicious NPM packages published as part of the PhantomRaven Wave 5 supply chain campaign execute a three-stage credential harvesting attack upon installation. Each package contains a self-referencing dependency pointing to an attacker-controlled server pack.nppacks.com that automaticall...