"The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns," CrowdStrike's Counter Adversary Operations said.
CrowdStrike: LLM likely used to craft PhantomRaven
CrowdStrike's Counter Adversary Operations attributed the development of a JavaScript information stealer called PhantomRaven to a financially motivated actor and said with "high confidence" that the developer likely used a large language model (LLM) to produce the malware. The assessment points to verbose comments, placeholder code, and token-analysis patterns as the basis for that conclusion.
CrowdStrike also characterized the operator's behavior as atypical for commodity criminal tooling: while "most criminal actors [...] rent commodity tools or operate their own proprietary malware," this operator appears to have developed a proprietary stealer — PhantomRaven — and used the compromises it produced to support claims to bug bounty programs.
Slopsquatting, RDDs and the mechanics of the npm campaign
PhantomRaven first drew attention in late October 2025 when researchers at Koi Security and DCODX flagged a slopsquatting and typosquatting campaign on the npm registry that uploaded more than 100 malicious packages. The packages served as a cover to retrieve a remote dynamic dependency (RDD) from an external server so the libraries themselves would not be directly flagged by defensive tools.
Once the remote dependency executed, the embedded malware scanned developer environments and harvested a range of information before transmitting results to an attacker-controlled server. Specifically, the stealer:
- looked for email addresses and collected Git/npm configuration username and email;
- gathered CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI;
- collected a system fingerprint that included the public IP address, runtime details, and the current date and time;
- was designed to exfiltrate those collected details to a remote server controlled by the operator.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildOperator identities, claimed bounties, and observed behavior
CrowdStrike's analysis ties the campaign to a single financially motivated operator active since November 2022. The operator has publicly claimed to be a bug bounty hunter and asserted having collected bounties from "no less than nine entities across the technology, retail, and hospitality sectors."
At least two npm accounts used to publish packages containing PhantomRaven were observed:
- jpdhellonpm1 — package: transform-jsbi-to-bigint
- jpd15 — package: sort-imports-es6-autofix
Both accounts were "no longer accessible as of writing." CrowdStrike additionally linked several other online identities to the operation, including jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh.
Notably, CrowdStrike reported it has not observed data stolen by PhantomRaven appearing on stealer log shops. The company interprets that absence to mean "the operator likely uses the information stealer solely to identify bug bounty opportunities" rather than to resell harvested credentials.
Security researcher Maddie Stewart also noted that in August 2025 the threat actor claimed to have achieved remote code execution (RCE) on a target via a malicious npm package, stating the actor had "compromised the target machine and executed their preinstall script." That claim, if accurate, would show the operator attempting to leverage package-install hooks to escalate from supply-chain access to full RCE.
Evidence of an attempted PyPI campaign
CrowdStrike's findings include evidence that the operator attempted to push packages to the Python Package Index (PyPI) containing code similar to PhantomRaven. That activity suggests the operator sought to expand the campaign beyond the npm ecosystem and reuse the same stealer behavior across multiple language package repositories.
What this means for technologists, bug-bounty programs, and package registries
- Technologists and security teams: Monitor for RDD-style behaviors and preinstall or install-time script execution originating from newly installed packages. Pay attention to telemetry that indicates collection of CI/CD environment variables, Git/npm configuration data, and unusual outbound connections that could indicate exfiltration to attacker-controlled servers.
- Bug-bounty programs and enterprise risk teams: Be prepared to scrutinize sudden, self-reported findings coming from researchers who claim rights to test production assets after alleged "compromises." CrowdStrike's report ties this actor's claimed hunting activity to an operational pattern of using stolen environment data to locate targets for disclosure claims.
- Package registry operators (npm and PyPI): The campaign highlights the continued utility of typosquatting and "slopsquatting" for attackers. The fact that more than 100 malicious packages were uploaded and that at least two publishing accounts were later inaccessible underscores the need for rapid detection and takedown mechanisms for typosquatted and dependency-based attacks.
PhantomRaven illustrates a convergence of tactics: typosquatting and remote dynamic dependencies to evade detection, automated data collection focused on developer and CI/CD secrets, and, per CrowdStrike, likely use of an LLM to accelerate malware development. The record shows an operator who appears to be monetizing access to compromised environments through a mix of claimed disclosure and targeted harvesting — a pattern that raises immediate questions for registries, incident responders, and bounty programs about how claims of "ethical" research should be validated against demonstrable intrusion activity.
https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html
