PhantomRaven: An AI-Written npm Stealer Built to Chase Bug Bounties

CrowdStrike has published an analysis of PhantomRaven, a malicious campaign built around a family of JavaScript infostealers distributed through the npm registry. It was first reported by Koi Security and DCODX in late October 2025, when it involved more than a hundred malicious packages uploaded to npm via typosquatting and so-called slopsquatting.

How the stealer worked

The packages themselves looked harmless: the malicious logic was pulled in from outside as a remote dynamic dependency (RDD) served by an external server, which kept the libraries off the radar of security tools. Once installed, the code scanned the developer's environment, harvesting email addresses, CI/CD environment details and a system "fingerprint," including the public IP address.

Separately, the stealer extracted launch-time information, usernames and email addresses from Git and npm configurations, as well as CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins and CircleCI. All of it was sent to the attacker's server. The targets were authentication tokens, build-pipeline secrets and GitHub credentials.

The fingerprints of a large language model

The most intriguing part is the origin of the code itself. In the assessment of the Counter Adversary Operations unit, the malware was written "with high confidence" using a large language model. The telltale signs are verbose comments, leftover stub code and statistical patterns in the distribution of tokens — characteristic traces of machine generation.

Bug bounties instead of the black market

The motive is even more unusual. The operator has been active since at least November 2022 and poses as a vulnerability hunter, claiming to have received rewards from no fewer than nine organizations in the technology, retail and hospitality sectors. Tellingly, the stolen data never surfaced on marketplaces where stealer logs are traded. From this the researchers conclude that the actor uses the infostealer not for resale, but solely to find grounds to report a vulnerability and collect a payout.

In August 2025 he claimed to have found a remote code execution (RCE) vulnerability: by his account, the victim's machine was compromised through a preinstall script in a published package. At least two npm accounts (both now inaccessible) and a whole set of other aliases have been linked to the campaign. There are also signs of attempts to upload a similarly coded stealer to the PyPI repository.

CrowdStrike notes that most criminals either rent ready-made tools or use their own software to profit directly. Here, an in-house build serves as leverage to then demand rewards from reputable vulnerability disclosure programs. And the use of AI, the company says, merely cuts down the time and effort required for operations like this.

Source: The Hacker News