Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
CrowdStrike ties the PhantomRaven npm infostealer, active since 2022, to a self-described bug bounty hunter who likely wrote it with an LLM.
CrowdStrike's Counter Adversary Operations assessed with high confidence that the PhantomRaven developer, active since November 2022 and claiming bounties from nine organizations, used an LLM to write the malware, citing verbose comments, placeholder code, and token-analysis patterns. First flagged by Koi Security and DCODX in late October 2025, the campaign uploaded more than 100 typosquatted and slopsquatted npm packages that retrieve a remote dynamic dependency to evade scanners, then harvest auth tokens, CI/CD secrets for GitHub Actions, GitLab CI, Jenkins, and CircleCI, Git/npm identities, and system fingerprints. npm accounts jpdhellonpm1 and jpd15 pushed the packages, and similar stealer code was also pushed to PyPI; stolen data has not appeared in stealer log shops, suggesting it is used to find bug bounty targets.
- 100+ typosquatted and slopsquatted npm packages pulled remote dynamic dependencies to evade detection.
- Steals authentication tokens, CI/CD secrets, GitHub credentials, Git/npm identities, and system fingerprints.
- CrowdStrike judged LLM authorship from verbose comments, placeholder code, and token-analysis patterns.
- Stolen data never surfaced in stealer log shops; allegedly used to identify bug bounty opportunities.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1005 Data from Local SystemT1552.001 Credentials In FilesT1041 Exfiltration Over C2 Channel
- Vendors
- npm
- Products
- PhantomRaven
- Malware
- PhantomRaven
- Organizations
- CrowdStrikeKoi SecurityDCODX
From the original article
2 min read at thehackernews.com
A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns,"
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.