{"id":82124,"date":"2026-09-18T05:59:22","date_gmt":"2026-09-18T09:59:22","guid":{"rendered":"https:\/\/overcentral.com\/en\/?p=82124"},"modified":"2026-09-18T05:59:22","modified_gmt":"2026-09-18T09:59:22","slug":"phantomraven-npm-stealer-82124","status":"publish","type":"post","link":"https:\/\/overcentral.com\/en\/phantomraven-npm-stealer-82124\/","title":{"rendered":"PhantomRaven npm Stealer Likely Built Using LLM"},"content":{"rendered":"

A financially motivated threat actor<\/a> has developed and distributed a JavaScript-based information stealer, PhantomRaven, through the npm package registry, with evidence strongly suggesting the malware was generated using a large language model (LLM). This conclusion, drawn by CrowdStrike’s Counter Adversary Operations team, is based on verbose comments, placeholder code, and statistical token-analysis patterns that align with LLM output characteristics. The campaign, first flagged by Koi Security and DCODX in late October 2025, involved more than 100 malicious packages uploaded to npm in a slopsquatting and typosquatting attack aimed at stealing authentication tokens, CI\/CD secrets, and GitHub credentials from developers’ machines.<\/p>\n

The Emergence of PhantomRaven: A Stealer Designed for Bug Bounty Hunting<\/h2>\n

PhantomRaven is not a typical information stealer deployed for credential harvesting or data resale. Instead, CrowdStrike’s analysis indicates that the operator likely uses the stolen information solely to identify and claim bug bounty opportunities. The cybersecurity firm noted that it has not observed any of the stolen data appearing on stealer log shops, a clear departure from the usual monetization patterns seen in commodity malware operations. The threat actor, active since November 2022 and claiming to be a bug bounty hunter, has reportedly collected bounties from at least nine entities across the technology, retail, and hospitality sectors.<\/p>\n

The malware is delivered through what security researchers term a remote dynamic dependency (RDD) approach. Packages uploaded to npm act as a decoy, retrieving a secondary malicious dependency from an external server. This technique evades static security analysis because the initial package itself contains no obviously harmful code. Once the remote dependency is executed on a developer’s machine, PhantomRaven begins its reconnaissance and data exfiltration routines.<\/p>\n

How PhantomRaven Operates: System Fingerprinting, Secrets Harvesting, and CI\/CD Exploitation<\/h2>\n

Upon installation, PhantomRaven performs a comprehensive survey of the compromised environment. The stealer scans for email addresses, gathers information about the CI\/CD pipeline, and collects a system fingerprint that includes the public IP address. It also extracts runtime details, current date and time, and configuration data from Git and npm settings, such as username and email. Critically, the malware targets environment variables used in popular CI\/CD platforms \u2014 GitHub Actions, GitLab CI, Jenkins, and CircleCI \u2014 seeking credentials, tokens, and other secrets that grant access to repositories, build pipelines, and cloud infrastructure.<\/p>\n

The stolen data is transmitted to an attacker-controlled server. The threat actor has demonstrated that PhantomRaven can be used to identify remote code execution (RCE) vulnerabilities. In August 2025, the actor claimed to have discovered an RCE vulnerability via a malicious npm package they themselves published, explaining that the package’s preinstall script allowed them to compromise a target machine and execute arbitrary code. This incident underscores the dual-use nature of the malware: it serves both as a reconnaissance tool for bug bounties and as a vector for gaining initial access to internal systems.<\/p>\n

Two npm Accounts Under the Operator’s Control<\/h3>\n

At least two distinct npm user accounts were observed pushing packages containing PhantomRaven: jpdhellonpm1<\/strong> (associated with the package transform-jsbi-to-bigint<\/em>) and jpd15<\/strong> (associated with sort-imports-es6-autofix<\/em>). Both accounts are no longer accessible. Additional online identities linked to the same operation include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh. The variety of usernames suggests an attempt to evade detection and maintain operational persistence despite account takedowns.<\/p>\n

The LLM Signature: Why Security Researchers Are Confident the Malware Was AI-Generated<\/h2>\n

CrowdStrike’s assessment that PhantomRaven was likely built using an LLM is grounded in several technical artifacts. The code contains verbose, explanatory comments that are atypical for manually crafted malware \u2014 often a telltale sign of LLM output. Placeholder functions and incomplete implementations further reinforce this conclusion. Statistical token-analysis patterns, which examine the frequency and distribution of code tokens, also aligned with known LLM generation signatures.<\/p>\n

This case is part of a broader trend in which threat actors incorporate LLMs into their development workflows to accelerate the creation of custom malware. Instead of renting commodity tools or relying on stolen code, operators can now generate functional stealer scripts in minutes. The use of LLMs reduces the technical barrier and compresses the time from idea to deployment, making supply chain attacks more accessible to a wider range of actors.<\/p>\n

Beyond npm: PyPI and the Expanding Attack Surface<\/h2>\n

The same threat actor has also attempted to push packages to the Python Package Index (PyPI) that contain an information stealer exhibiting similarities to PhantomRaven. Although the PyPI campaign appears less developed than the npm effort, it demonstrates an intent to target multiple ecosystems. Software supply chain attacks on package registries are not new, but the combination of LLM-generated code and an operator who professes to be a bug bounty hunter introduces a novel risk profile. The attacker leverages legitimate bug bounty programs as a cover for otherwise criminal activity, blurring the line between ethical disclosure and opportunistic exploitation.<\/p>\n

Strategic Implications for Software Supply Chain Security<\/h2>\n

The PhantomRaven campaign highlights vulnerabilities inherent in open package ecosystems. Developers routinely install dependencies without verifying the source or inspecting package code, and the RDD technique effectively bypasses many automated security scanners. The involvement of an LLM in malware development signals that the sheer volume of novel malicious packages is likely to increase. Security teams must adapt by implementing runtime monitoring, dependency auditing, and behavioral analysis rather than relying solely on static scans of package contents.<\/p>\n

Furthermore, the bug bounty angle introduces a perverse incentive structure: an attacker can compromise a company to find vulnerabilities, then report those vulnerabilities for a reward, all while retaining the stolen data and access. This creates ethical and legal ambiguities that bug bounty programs are not designed to handle. Program operators may need to reexamine eligibility criteria and invest in documented safeguards to prevent exploitation by hostile actors masquerading as researchers.<\/p>\n

The PhantomRaven case is a stark reminder that the software supply chain<\/a> is only as strong as its weakest dependency. As LLM capabilities mature, the speed and sophistication of these attacks will likely increase. Organizations must prioritize securing their CI\/CD pipelines, enforcing least-privilege access for environment variables, and educating developers about the risks of installing untrusted packages \u2014 especially those from accounts with suspicious histories or those engaging in typosquatting. The threat actor behind PhantomRaven may be unique in its self-identification as a bug bounty hunter, but the methods it employs are a template that others will inevitably follow.<\/p>\n","protected":false},"excerpt":{"rendered":"

A financially motivated threat actor has developed and distributed a JavaScript-based information stealer, PhantomRaven, through the npm package registry, with evidence strongly suggesting the malware was generated using a large language model (LLM). This conclusion, drawn by CrowdStrike’s Counter Adversary Operations team, is based on verbose comments, placeholder code, and statistical token-analysis patterns that align […]<\/p>\n","protected":false},"author":7,"featured_media":82126,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/pub-4d4fc17555de4152be07eaf2a416a31e.r2.dev\/en\/ocie_1789725565843.jpg","fifu_image_alt":"PhantomRaven npm Stealer Likely Built Using LLM","footnotes":""},"categories":[40668],"tags":[],"class_list":["post-82124","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"fifu_image_url":"https:\/\/pub-4d4fc17555de4152be07eaf2a416a31e.r2.dev\/en\/ocie_1789725565843.jpg","fifu_image_alt":"PhantomRaven npm Stealer Likely Built Using LLM","_links":{"self":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/82124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/comments?post=82124"}],"version-history":[{"count":1,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/82124\/revisions"}],"predecessor-version":[{"id":82125,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/posts\/82124\/revisions\/82125"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media\/82126"}],"wp:attachment":[{"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/media?parent=82124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/categories?post=82124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/overcentral.com\/en\/wp-json\/wp\/v2\/tags?post=82124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}