Ghost Campaign Supply Chain Attacks Persist in Developer Ecosystems (thehackernews.com)

• Ghost campaign identified in February 2026.
• Malicious npm packages with fake installation logs.
• Targets sudo passwords and deploys RATs for credential and crypto theft.

"The Ghost campaign, first identified in February 2026, continues to threaten developers by using malicious npm packages with fake installation logs to phish for sudo passwords and deploy remote access trojans (RATs) for credential and cryptocurrency theft."