Claimed Bug Bounty Hunter Likely Used LLM to Build Phantom Raven npm Stealer
Summary: CrowdStrike linked a financially motivated actor to PhantomRaven, a JavaScript information stealer distributed through more than 100 malicious npm packages first flagged in late October 2025, which pulled a remote dynamic dependency from an external server to evade security tools and harvested authentication tokens, CI/CD secrets, and GitHub credentials. CrowdStrike assessed with high confidence that the developer wrote the malware using a large language model, based on verbose comments, placeholder code, and statistical token-analysis patterns, and said the actor has been active since November 2022 while claiming to be a bug bounty hunter paid by at least nine entities.
What's compelling: The operator reportedly used stolen data only to find bug bounty opportunities, not to sell on stealer log shops, so a compromise of your developer environment may surface first as someone else's bounty claim rather than as a listing for sale. Two npm accounts pushing PhantomRaven are already inaccessible, and the same actor has attempted PyPI uploads.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026