# Understanding the recent npm malware attacks

## What happened, why it matters, and how Sonatype protects you from npm-ecosystem malware

Two npm-ecosystem malware attacks, **PhantomRaven (SonatypeID: sonatype-2025-004344)** and **IndonesianFoods (SonatypeID: sonatype-2025-004546)**, were recently identified. Both of these attacks are novel developments in malware sophistication and aggression. PhantomRaven abuses a feature of npm to hide dependencies from surface-level threat scanners while give attackers contextual control over payloads. IndonesianFoods, like the Shai-Hulud attack earlier this fall, is self-replicating, capable of publishing new, infected packages to npm automatically.

These new characteristics highlight the importance of proactive malware defense. Sonatype Repository Firewall draws provides real-time protection by automatically quarantining malicious components at the moment they would enter your environment. For more detailed information, see our documentation on [how Sonatype identifies malware](https://help.sonatype.com/en/sonatype-malware-data.html "Sonatype Malware Data") and review our blog posts on the [PhantomRaven attack](/content/blog/phantomraven-npm-malware/index.html) and [IndonesianFoods attack](/content/blog/unprecedented-automation-indonesianfoods-pits-open-source-against-itself/index.html).

## What to do if your files have been compromised

**Prerequisites**  
To take advantage of the remediation steps outlined below, customers must be on **Nexus Repository Pro version 3.73.0** or higher. Customers must also have **Sonatype Repository Firewall**, and the IQ Server and Nexus Repository must be connected.

If a malicious component was downloaded before Repository Firewall was properly configured, you can use the following steps to find and remove it:

1. Using Nexus Repository:
   
   1. Check for the Malware Banner on your repository dashboard (**version 3.73.0 or higher**), which indicates that a malicious component has been identified. Download a CSV list of components from the Malware Banner.
   
   2. To remove the malicious components, run the Automatic Malware Management task on the affected proxy repositories (**version 3.77.0 or higher**). This task, when enabled with Enable Malware Cleanup, will automatically delete the malicious components from your repository. For details, including instructions for creating the task, refer to the [Automatic Malware Management task documentation](https://help.sonatype.com/en/malware-risk.html#automatic-malware-management-task "Automatic Malware Management Task").
   
   |     |
   | --- |
   |  |

2. Using IQ Server:
   
   1. Utilize Advanced Search in IQ Server to find any violations related to these specific attacks. For PhantomRaven, use the following search criteria:
   
      ```
      vulnerabilityId:sonatype-2025-004344
      ```
   
      And for IndonesianFoods, use the following search criteria:
   
      ```
      vulnerabilityID:sonatype-2025-004546
      ```
   
      To search both at the same time, separate the search criteria with “OR.”
   
      ```
      vulnerabilityId:sonatype-2025-004344 OR vulnerabilityID:sonatype-2025-004546
      ```
   
      If Advanced Search returns results, then a Lifecycle scan has identified these components in your codebase. Follow your internal incident response policy and aim to remove those packages from your builds and manifest files immediately.
   
      For a comprehensive guide on the manual process of removing malware and handling the malware banner, please consult the [Guide to Removing Malware](https://help.sonatype.com/en/guide-to-removing-malware.html "Guide to Removing Malware").

## Check now that your deployments of Nexus Repository and Repository Firewall were/are correctly configured to block malware

Open Repository Firewall and:

1. Confirm that all proxy repositories for the npm ecosystem have Audit and Quarantine enabled. Sort the list by Format to quickly identify npm proxy repositories.
   
   |     |
   | --- |
   |  |

Read more: [Audit and Quarantine documentation](https://help.sonatype.com/en/firewall-audit-and-quarantine-capability.html)

2. Confirm that your _Integrity-Rating_ and _Security-Malicious_ policies are configured correctly. Make sure they match these screenshots exactly, including the Policy Name field.

#### Integrity-Rating:
   
To understand the protection provided by the Release Integrity policy please see our [Release Integrity documentation](https://help.sonatype.com/en/release-integrity.html "Release Integrity"). Policy Compliant Component Selection should also be considered in conjunction with this policy to minimize impact from the latest suspicious packages.

|     |
| --- |
|  |

#### Security-Malicious:

|     |
| --- |
|  |

3. Confirm that both of these policies are set to "Fail" at the proxy stage.

|     |
| --- |
|  |

**If all of these things are confirmed,** congratulations: You're protected against these npm malware attacks and the 850,000+ other malicious packages Sonatype has cataloged!

## Demo: Configuring Nexus Repository and Repository Firewall

The interactive demo below walks you through configuring the _Automatic Malware Management_ task in Nexus Repository and the _Integrity-Rating_ and _Security-Malicious_ policies in Repository Firewall. Select the _Next_ button below to navigate through the interactive demo:

Automatic Malware Management  
  
  
This demo has not been configured for mobile viewing yet. Please come back on a larger screen to experience this demo.

## Next Steps

**Malware attacks are more frequent, more sophisticated, and more dangerous than ever.** Maximize your protection against future malware attacks by doing the following:

- Review the _Integrity-Rating_ and _Security-Malicious_ policies on a regular cadence and ensure they're set to "Fail" at the Proxy stage. If you're also a Sonatype Lifecycle customer, it's wise to set them to "Fail" at every stage. Remember – **there's**_**never**_**a legitimate reason for malware to be in your development ecosystem.**

- Eliminate development disruption caused by the _Integrity-Rating_ policy by also configuring [Policy Compliant Component Selection](https://help.sonatype.com/en/policy-compliant-component-selection.html).

- Consider setting the _Component-Unknown_ policy to also fail at the proxy stage. This protects you from malware that Sonatype hasn’t yet ingested or evaluated.

- Create an Audit and Quarantine capability for every new proxy repository.

- Enable [Automatic Quarantine Release](https://help.sonatype.com/en/automatic-quarantine-release.html) so that components are released from quarantine automatically if new data confirms they're safe. This avoids developer friction and minimizes "false positives."

- If you're a Sonatype Lifecycle or Sonatype SBOM Manager customer, [turn on Continuous Monitoring](https://help.sonatype.com/en/continuous-monitoring.html). This will alert stakeholders if malware appears in your apps unexpectedly.

- Educate developers on the importance of routing component requests through Nexus Repository. All requests for open-source components, regardless of ecosystem or package manager, should go through Nexus Repository.

- For additional protection, [integrate Repository Firewall with Zscaler](https://help.sonatype.com/en/zscaler.html "Integrate Firewall with Zscaler") to block downloads of known malware even when developers bypass Nexus Repository.

## Additional Resources

[Malware vs. Vulnerabilities eLearning](https://learn.sonatype.com/learn/courses/91/open-source-malware-vs-vulnerabilities)  
[Guide to Removing Malware](https://help.sonatype.com/en/guide-to-removing-malware.html)  
[Sonatype Malware Data](https://help.sonatype.com/en/sonatype-malware-data.html)  
[Shadow Downloads eLearning](https://learn.sonatype.com/learn/courses/37/best-practices-shadow-downloads)