CrowdStrike Links PhantomRaven npm Campaign to Claimed Bug Hunter

PhantomRaven campaign tied to claimed bug bounty hunter

CrowdStrike has linked the JavaScript-based PhantomRaven information stealer, distributed through the npm registry, to a financially motivated threat actor who claims to be a bug bounty hunter. The actor says they have received rewards from at least nine entities in the technology, retail and hospitality sectors.

PhantomRaven was first identified by Koi Security and DCODX in late October 2025. Researchers described a slopsquatting and typosquatting operation that uploaded more than 100 malicious npm packages intended to steal authentication tokens, CI/CD secrets and GitHub credentials from developer machines.

CrowdStrike assesses with high confidence that the malware was likely written with help from a large language model. Its assessment cites verbose comments, placeholder code and statistical token-analysis patterns. The finding illustrates how LLM use can reduce the time and effort needed to build tooling for supply-chain campaigns.

Remote dependency designed to reduce detection

The malicious packages acted as a delivery mechanism for a remote dynamic dependency, or RDD, fetched from an external server. This arrangement meant the libraries in the npm registry did not contain the full malicious capability, reducing the likelihood that security tools would flag them at publication or installation time.

Once installed, the code in the remote dependency scanned the developer environment for email addresses, CI/CD information and a system fingerprint that included the public IP address. It then sent the collected data to attacker-controlled infrastructure.

The stealer could also collect runtime details, the current date and time, usernames and email addresses stored in Git and npm configuration, and CI/CD environment variables. The targeted services included GitHub Actions, GitLab CI, Jenkins and CircleCI.

Accounts and cross-registry activity

CrowdStrike said the operator has been active since November 2022. At least two npm accounts associated with the operation, jpdhellonpm1 and jpd15, were observed publishing packages containing PhantomRaven. The accounts were no longer accessible when the analysis was published.

One package was named transform-jsbi-to-bigint, while another was sort-imports-es6-autofix. CrowdStrike also linked several other online identities to the activity, including jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11 and packagedharsh.

Security researcher Maddie Stewart noted that the actor claimed in August 2025 to have found a remote code execution vulnerability using a malicious npm package and a preinstall script. CrowdStrike also found evidence of attempted PyPI uploads containing information-stealer code with similarities to PhantomRaven.

CrowdStrike has not observed stolen data from PhantomRaven appearing in stealer-log shops and assesses that the operator may use the collected information to identify bug-bounty opportunities. Businesses should therefore review dependency controls, inspect install-time behaviour and restrict CI/CD secrets so a package installation cannot expose credentials or build environments.