Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

A financially motivated threat actor, claiming to be a bug bounty hunter, has been linked to the development and distribution of PhantomRaven, a JavaScript information stealer, via the npm package registry. The malware utilizes a large language model (LLM) to generate its code and steal sensitive data like authentication tokens, CI/CD secrets, and GitHub credentials. The actor has been active since November 2022 and has exploited vulnerabilities to claim bug bounties, operating independently and using stolen data to identify new opportunities.

PhantomRaven was first flagged by Koi Security and DCODX in late October 2025, calling attention to a slopsquatting and typosquatted campaign in which more than 100 malicious packages were uploaded to npm to steal authentication tokens, CI/CD secrets, and GitHub credentials. The malware employs a remote dependency (RDD) to avoid detection by security tools.

Once installed, the malware scans the developer environment for email addresses, gathers information about the CI/CD environment, collects a system fingerprint, including the public IP address, and transmits the results to an attacker-controlled server. It is also equipped to collect runtime details, current date and time, username and email addresses from Git/npm configurations, as well as CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI.

CrowdStrike’s analysis indicates the threat actor has been active since November 2022 and claims to have discovered a remote code execution (RCE) vulnerability via a malicious npm package they published in August 2025. The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE.

Evidence has emerged that the threat actor attempted to push packages to the Python Package Index (PyPI) repository containing code for an information stealer that exhibits similarities with PhantomRaven. The likely use of a large language model (LLM) to generate the malware once again highlights how threat actors are increasingly adopting the technology in their operations, compressing the time and effort it takes to pull off such campaigns. Two npm user accounts maintained by the operator have been observed pushing npm packages containing PhantomRaven: jpdhellonpm1 - transform-jsbi-to-bigint and jpd15 - sort-imports-es6-autofix. Other online identities linked to the same operation include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh.