PhantomRaven Used npm Packages and Remote Code to Hunt for Developer Secrets

CrowdStrike has linked a financially motivated operator posing as a bug bounty hunter to PhantomRaven, a JavaScript information stealer distributed through more than 100 malicious npm packages.

The supply-chain campaign targeted developers through slopsquatting and typosquatting. Once installed, the packages retrieved additional code from attacker-controlled infrastructure, allowing PhantomRaven to inspect development systems and exfiltrate credentials, configuration details, and CI/CD secrets.

CrowdStrike assesses with high confidence that a large language model helped produce the malware. The evidence includes unusually extensive code comments, incomplete placeholder sections, and statistical analysis of the source code’s token patterns.

More than 100 packages targeted developer environments

Koi Security and DCODX first identified the campaign in late October 2025. The malicious packages were placed in the npm registry, where developers could encounter them while searching for dependencies or entering package names.

The operation combined two naming strategies. Typosquatting relies on names resembling legitimate packages, hoping that users will make spelling mistakes or overlook subtle differences. Slopsquatting targets package names that appear plausible but may be suggested by an LLM even though no legitimate package exists under that name.

More than 100 packages were uploaded during the campaign. However, a complete package-removal list, affected version inventory, and npm security advisory have not been disclosed.

At least two npm accounts were associated with published PhantomRaven packages:

• jpdhellonpm1, which published transform-jsbi-to-bigint
• jpd15, which published sort-imports-es6-autofix

Both accounts were inaccessible when the findings were prepared. Other identities connected to the activity include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh.

The loss of access to two accounts provides some containment, but it does not establish that every malicious package or related identity has been removed. There is also no public confirmation that all associated attacker infrastructure has been disabled.

Remote dependencies concealed the stealer’s main functionality

PhantomRaven’s delivery model separates the package visible in npm from the code responsible for most of the malicious behavior.

The packages use an external remote dynamic dependency, or RDD, hosted on a server controlled by the operator. After installation, the package retrieves executable functionality from that infrastructure. This approach leaves less obviously malicious code inside the npm archive itself and makes static inspection of the published package less reliable.

It also gives the operator flexibility. Code delivered remotely can potentially be changed without publishing a new package version, while defenders examining only the registry artifact may not see the same functionality that ran on a victim’s machine.

The retrieved code scans the developer environment and can collect:

• Email addresses and other developer identity data.
• Information about the local CI/CD environment.
• A system fingerprint that includes the machine’s public IP address.
• Runtime details and the current date and time.
• Usernames and email addresses stored in Git and npm configuration.
• Environment variables associated with GitHub Actions, GitLab CI, Jenkins, and CircleCI.
• Authentication tokens, source-control credentials, and other exposed secrets.

The harvested information is transmitted to an attacker-controlled server.

No destructive or ransomware-like behavior has been reported. There is no evidence that PhantomRaven encrypts data, damages systems, or deliberately disrupts build pipelines. Its documented purpose is information collection.

Even so, the consequences can extend beyond the developer workstation. A stolen CI/CD token may provide access to source repositories, build systems, deployment workflows, or other company resources, depending on the token’s permissions.

LLM fingerprints appeared in the malware’s source code

CrowdStrike attributed LLM assistance with high confidence rather than claiming direct proof of which model or service was used. The assessment rests on several characteristics found in PhantomRaven’s code.

One signal was the volume and style of comments. Malware developers sometimes document code, but verbose explanations that restate straightforward operations can resemble output produced by coding assistants. Researchers also found unfinished placeholder logic, suggesting that generated scaffolding may not have been fully completed or cleaned up.

Statistical token analysis provided another indicator. This type of analysis examines patterns in how code and accompanying text are constructed, looking for distributions consistent with model-generated output.

None of those characteristics alone proves AI involvement. Comments can be written manually, placeholders are common in unfinished software, and token-based classifiers are not infallible. Taken together, however, they led CrowdStrike to conclude that an LLM probably helped create PhantomRaven.

The finding does not mean the campaign was autonomous. A human operator still appears to have selected targets, created registry identities, published packages, maintained external infrastructure, and received the stolen information.

The operational value of generative AI is more practical: it can reduce the effort required to draft code, explain unfamiliar APIs, produce variations, and assemble a working tool. PhantomRaven shows how those efficiencies can be applied to software-supply-chain attacks rather than legitimate development.

The operator presented the activity as bug-bounty research

CrowdStrike says the actor has been active since November 2022 and publicly presents as a bug bounty hunter. The individual reportedly claims to have received rewards from at least nine organizations across the technology, retail, and hospitality industries.

Maddie Stewart reported that, in August 2025, the actor claimed to have found a remote-code-execution issue by using a malicious npm package. According to that claim, the package compromised a target machine by executing its preinstall script and allegedly achieved remote code execution.

That account raises a fundamental distinction between authorized security testing and compromise. Publishing a package that steals information or executes code on systems without explicit permission is not equivalent to testing within a defined bug-bounty scope.

CrowdStrike has not observed PhantomRaven data being advertised on stealer-log marketplaces. The company therefore assesses that the operator probably uses the malware to identify potential bug-bounty findings rather than selling collected data through established criminal channels.

That assessment describes the likely motivation, not the legitimacy of the technique. Developer identities, tokens, and CI/CD variables remain sensitive data regardless of whether the operator intends to monetize them through a bounty submission or a criminal market.

The actor also appears to have attempted to publish packages containing similar information-stealing code to the Python Package Index, or PyPI. The known activity therefore may not be limited to the npm ecosystem.

Defenders must investigate dependencies and exposed secrets

There is no vendor patch because PhantomRaven is not a vulnerability in a specific software product. No CVE, CVSS score, formal severity rating, confirmed victim count, detection signature, or comprehensive remediation notice has been reported.

Organizations should begin by reviewing npm dependencies, lockfiles, installation records, and internal package caches for unexpected libraries. The two publicly identified packages, transform-jsbi-to-bigint and sort-imports-es6-autofix, warrant direct investigation, but they should not be treated as a complete indicator list.

Security teams should also examine:

• Package installation events that triggered preinstall or other lifecycle scripts.
• Outbound connections initiated during dependency installation.
• Dependencies that download executable code from infrastructure outside npm.
• Unexpected access to Git and npm configuration files.
• Processes reading CI/CD environment variables.
• Recently created or modified credentials associated with developer and automation accounts.

If a suspicious package ran, removing it is not sufficient. Potentially exposed GitHub, GitLab, npm, Jenkins, CircleCI, and other CI/CD credentials should be revoked or rotated, with repository and pipeline logs reviewed for subsequent access.

Teams can reduce future exposure by pinning dependencies, enforcing lockfiles, restricting lifecycle scripts where operationally possible, and controlling network access during builds. New packages should be evaluated for publisher history, source availability, unexpected remote downloads, and discrepancies between their stated purpose and installation behavior.

PhantomRaven’s central advantage was not sophisticated exploitation. It was access created by developer trust, combined with remote code that remained outside the package initially inspected.