AI Supply Chain Security Just Met Its Phantom Raven Problem

What Phantom Raven actually proved about AI supply chain security#

A fox does not need to see the whole thicket to know something in it has changed shape. Koi Security's researchers, Oren Yomtov and Idan Dardikman, spotted that shape shift in npm's undergrowth last October, and by the time Help Net Security's interview with Zentera Systems' Jaushin Lee ran this week, the campaign they found, Phantom Raven, had become the clearest evidence yet that ai supply chain security is not a future problem. It is a present one, already counted in downloads.

The mechanics are almost embarrassingly simple once Koi Security's own report lays them out. npm has long supported Remote Dynamic Dependencies, an obscure feature letting a package.json entry fetch its payload from an attacker-controlled URL at install time rather than from the registry itself. Static scanners read the manifest, see a normal-looking dependency, and never follow the link. The scanner is not lazy. It is doing exactly what it was built to do, and the trick works precisely because it does.

Koi counted 126 malicious packages built this way, 80 of them still live and quietly collecting installs when the researchers found them, and more than 86,000 combined downloads before the campaign was disrupted. Those are not projections. They are a receipt.

What makes Phantom Raven a story about ai supply chain security rather than an ordinary typosquat is the naming. The attackers did not misspell popular packages the way a decade of typosquatting campaigns have. They picked names that sound exactly like the plausible alternative an AI coding assistant invents when the real package is not quite what the assistant remembers: names like unused-imports and eslint-comments, close cousins of real tools with slightly different addresses. A developer who trusts the suggestion never checks the street sign.

Software supply chain security has spent a decade building defences for a threat that assumed a human typed the dependency name. npm's own audit tooling compares a project's dependency tree against known advisories, a fine defence against a package that is already flagged. It is no defence at all against a package invented an hour before a developer's AI assistant suggested it.

How slopsquatting turns a coding assistant into quarry#

Slopsquatting is the ugly, accurate name security researchers gave this pattern: an attacker does not guess which package name a developer might mistype, they guess which package name an AI coding assistant will hallucinate, then register it first. It works because a large language model does not know it is inventing anything. It states a plausible dependency with the same fluent confidence it uses for a real one, and a developer mid-flow rarely stops to check whether the recommendation actually exists on the registry it is about to pull from, which is precisely the ai supply chain security failure mode Phantom Raven weaponised.

The prior literature, and why it undersold the danger#

The first serious measurement of this came from Spracklen and colleagues at USENIX Security 2025, who generated 576,000 code samples across sixteen models and found hallucinated packages in at least 5.2 percent of commercial-model output and 21.7 percent of open-source-model output. That spread was the working assumption most teams carried into 2026: hallucination was common, model-dependent, and presumably shrinking as vendors improved their tools.

A newer, narrower study complicates the comfort in that shrinkage. Aleksandr Churilov's 2026 preprint, tested against five frontier models across nearly 200,000 paired prompts, found the range had compressed hard: from 4.62 percent at the low end to 6.10 percent at the high end. Read quickly, that looks like good news, hallucination is rarer and more consistent across vendors than the 2025 spread suggested. Read carefully, it is worse. A rarer, narrower failure that every model shares is a smaller, better-lit target, not a safer one, and an ai supply chain security instrument this fine-grained is rare enough to take seriously.

Three other frontier models, Claude Sonnet 4.6, Gemini 2.5 Pro and DeepSeek V3.2, fell somewhere inside that same narrow band, which is the detail that matters more than either endpoint. When every major coding assistant hallucinates roughly the same handful of plausible names, an attacker does not need to guess a developer's toolchain. They need to guess the name once, and it works everywhere the same trail leads.

This is where earlier hallucination research from Krishna and colleagues becomes useful again: they found hallucination rate tracks inversely with a model's coding-benchmark performance, meaning the industry's own incentive, ship a model that scores well on standard coding tests, quietly doubles as an incentive to shrink this specific exposure. Nobody built that fix on purpose. It is a side effect worth noticing, not a plan worth trusting.

The registry defence gap, in one honest chart#

Here is the number that should worry a security team more than the headline malware count. Churilov's testing did not just measure how often models hallucinate, it checked whether different models hallucinate the same names. If five separate systems, built by five separate labs, independently invent an identical package name, an attacker only has to register that one name once to compromise ai supply chain security for every developer using any of the five.

The study found 127 hallucinated package names that all five tested models invented identically: 109 on PyPI, 18 on npm. Researchers at Socket then checked those names against the live registries as part of a coordinated disclosure, and confirmed how many an attacker could still have claimed.

Fifty-three of a hundred and twenty-seven is not a defence, it is closer to a coin flip that happens to land the registry's way slightly more often than not. Socket's review corrected some of the raw count, framework-provided names like Ember's virtual modules that exist in source code but have no standalone registry entry, and the true number still held. Software supply chain security, as currently built, catches the names it already recognises. It does not yet catch the name a machine is about to invent for the first time.

That gap is exactly where Phantom Raven's attackers worked, and exactly where the next campaign built on the same trick will prowl next, because ai supply chain security tooling still treats package hallucination as a quality bug in the model rather than an open gate in the registry.

Real risk versus rumour: what Zentera's CEO separates out#

Not every AI security fear is proven, and conflating the proven with the speculative is its own risk, because it trains security teams to treat every warning as equally urgent until none of them feel urgent at all. Jaushin Lee, Zentera Systems' CEO, drew that line deliberately in his interview this week, and genuine ai supply chain security fears deserve exactly this kind of triage.

Lee's real-versus-theoretical split puts Phantom Raven firmly in the real column and two other frequently cited dangers, poisoned model weights and compromised MCP servers, in the theoretical one, meaning they live in security research and conference demonstrations rather than confirmed incidents today. That does not make them safe to ignore. Researchers have already shown both are technically achievable. It means a defender's limited attention should go where the proof already sits.

The self-hosting instinct many teams reach for here is, in Lee's own words, a false comfort. Running your own model keeps data off a third party's servers, which genuinely matters, but it does nothing about a dependency that fetches its payload from an attacker's URL the moment it installs. Ai model security and ai supply chain security are related problems, not the same problem, and a fix for one does not touch the other.

The control Lee names instead, containment scoped to task and intent, matches what Phantom Raven exposed: the packages did not need a clever exploit once installed, they needed the ordinary permissions any install script already has. Limiting what an install script can touch closes the actual door, rather than the theoretical one, and it is a habit any team practising real ai model security should already own.

Software supply chain security habits that actually close the gap#

None of this requires abandoning AI coding assistants, which is the answer every team actually wants. It requires treating a suggested package name the way a fox treats a scent that smells almost right: worth a second sniff before committing the whole hunt to it, and worth building into the daily ai supply chain security discipline that actually holds.

Scale is the other half of the argument for doing this properly. Sonatype's 2026 supply chain report counted more than 454,000 new malicious open source packages in a single year, over 99 percent of them on npm, against 1.233 million known and blocked since tracking began. Against that scale, Phantom Raven's 126 packages are a rounding error, and ai supply chain security is a smaller fight sitting inside a much larger one. What made it a story worth Help Net Security's attention was not the volume, it was the method: the first widely reported campaign built specifically to exploit what an AI coding assistant would suggest, rather than what a tired developer might mistype.

GitHub has moved on this since well before Phantom Raven surfaced. Staged publishing now holds a package for approval and two-factor authentication before it goes live, decoupling the credentials a CI pipeline uses from the credentials that can actually publish. As of the end of July 2026, tokens configured to bypass two-factor authentication can no longer manage npm accounts, organisations or packages at all. None of that stops a model from hallucinating a name. All of it narrows how much damage the hallucination can do once an attacker claims it.

Treat every one of these as a software supply chain security habit rather than a one-time audit, because Phantom Raven will not be the last campaign built around a hallucinated name, and ai supply chain security only holds up if the habits outlast this week's headline.

What this means if you have to talk about the risk, not just patch it#

Security teams fix Phantom Raven-style gaps with tooling. Marketing teams have a harder job: explaining a risk this technical to a buyer, a board or a journalist without either understating it into a shrug or overstating it into a panic that ages badly the moment the facts settle. Ai supply chain security is a genuinely new category of risk, and it deserves genuinely accurate language, not the nearest available superlative.

The operators who come out of this news cycle looking credible will be the ones who can state, plainly and with a source attached, what happened (126 packages, a real technique, a real disclosure), what remains theoretical (poisoned weights, compromised MCP servers), and what a customer should actually do about it. That discipline applies across regulated content generally: a claim survives scrutiny because it is specific and sourced, not because it sounds confident.

The same discipline shows up elsewhere in folkfox's own cybersecurity coverage: how a $140 million funding round tested the real price of DSPM for ai model security, how four SAML bypasses exposed the gap between finding a flaw and fixing it, and how a perfect Entra ID score still needed identity security posture management to catch what the score missed. Ai supply chain security is the newest entry in that pattern, not an exception to it.

If your organisation sells into security-conscious buyers, whether that is fintech, healthcare or the security vendors themselves, the Phantom Raven story is a usable case study for exactly the kind of evidence-first content that earns citations rather than scepticism. That is content marketing and SEO and GEO work folkfox already does for fintech and healthcare clients who need ai supply chain security messaging that survives scrutiny, not just a scroll.

Frequently asked questions#