A threat actor who presents as a bug bounty hunter likely wrote the PhantomRaven JavaScript information stealer using a large language model, according to CrowdStrike's Counter Adversary Operations. The assessment was made with high confidence, citing verbose comments, placeholder code, and statistical token-analysis patterns.

PhantomRaven was first flagged in late October 2025 by Koi Security and DCODX, which described a slopsquatting and typosquatting campaign that uploaded more than 100 malicious packages to npm to steal authentication tokens, CI/CD secrets, and GitHub credentials. The packages retrieved a remote dynamic dependency from an external server so the libraries themselves would not be flagged.

Once installed, the malware scanned developer environments for email addresses, CI/CD details, and a system fingerprint including the public IP address, then sent results to an attacker-controlled server. It also collected runtime details, date and time, usernames and emails from Git/npm configurations, and CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI.

CrowdStrike said the actor has been active since November 2022 and claims bounties from at least nine entities in technology, retail, and hospitality. Stolen data has not been seen on stealer log shops, suggesting the operator uses the stealer only to find bug bounty opportunities. Two npm accounts pushing PhantomRaven packages, jpdhellonpm1 and jpd15, are no longer accessible. Other linked identities include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh.

Researcher Maddie Stewart noted that in August 2025 the actor claimed to have found a remote code execution vulnerability through a malicious npm package they published. Evidence also suggests attempts to push similar stealer code to PyPI.

Source: The Hackers News