A new JavaScript-based information stealer, **PhantomRaven**, has been observed infiltrating developer environments through the **npm** package registry. This sophisticated malware campaign is attributed to a financially motivated threat actor, with a unique characteristic: the likely use of a large language model (LLM) in its development. ### LLM's Hand in Malware Creation **CrowdStrike's Counter Adversary Operations** highlighted in a recent analysis that the malware's verbose comments, placeholder code, and statistical token-analysis patterns strongly suggest LLM involvement. This marks a significant shift, demonstrating how threat actors are increasingly leveraging AI to accelerate and streamline malware development. ### The Modus Operandi **PhantomRaven** was initially detected in late October 2025 by **Koi Security** and **DCODX**. The campaign involved a typosquatting and slopsquatting strategy, with over 100 malicious packages uploaded to **npm**. These packages were designed to steal authentication tokens, CI/CD secrets, and **GitHub** credentials from developers' machines. Crucially, the attack employs a remote dynamic dependency (RDD) from an external server. This tactic allows the malicious payload to be retrieved post-installation, helping the packages themselves evade initial scrutiny by security tools. ### Data Exfiltration and Targets Once activated, the malware embedded in the RDD meticulously scans the developer environment. It gathers email addresses, collects CI/CD environment information, and creates a system fingerprint, including the public IP address. All this data is then exfiltrated to an attacker-controlled server. Further analysis reveals its capability to collect runtime details, current date and time, usernames and email addresses from **Git** and **npm** configurations, and critical CI/CD environment variables across platforms like **GitHub Actions**, **GitLab CI**, **Jenkins**, and **CircleCI**. ### A Bug Bounty Hunter's Deception? **CrowdStrike's** findings indicate the threat actor has been active since November 2022. Interestingly, the operator claims to be a bug bounty hunter, alleging to have collected bounties from at least nine entities spanning technology, retail, and hospitality sectors. However, **CrowdStrike** has not observed the stolen information appearing on typical stealer log shops, suggesting the operator might be using the stolen data primarily to identify legitimate bug bounty opportunities. Multiple **npm** user accounts linked to the operation, such as `jpdhellonpm1` (for `transform-jsbi-to-bigint`) and `jpd15` (for `sort-imports-es6-autofix`), have since been taken down. Other online identities associated with this activity include `jpd12`, `jpd13`, `npmhell`, `npmpackagejpd`, `npmtestdharsh`, `jpdhackerone11`, and `packagedharsh`. Security researcher **Maddie Stewart** noted an incident in August 2025 where the threat actor claimed to have discovered a remote code execution (RCE) vulnerability via a malicious **npm** package they published, asserting they compromised a target machine and achieved RCE through a preinstall script. ### Expanding Horizons Evidence also suggests the threat actor attempted to push similar information-stealing packages to the **Python Package Index (PyPI)** repository, indicating a potential broadening of their target scope beyond the JavaScript ecosystem. The emergence of **PhantomRaven** serves as a stark reminder of the evolving threat landscape in software supply chain security and the increasing sophistication of threat actors, now empowered by accessible AI tools like LLMs.