Do Son Koi Security exposed PhantomRaven, an npm supply chain attack using 126 packages. It leverages Remote Dynamic Dependencies (RDD) and AI slopsquatting to steal GitHub/CI/CD secrets from 86,000+ downloads.
Slopsquatting
PyPI has banned inbox.ru registrations after a large-scale spam campaign created over 1,500 fake projects, exploiting name confusion and impersonation.