A financially driven cybercriminal group has been linked to the creation and dissemination of PhantomRaven, a JavaScript-based malware. This malicious software is being distributed through the npm package registry, targeting developers to extract sensitive information.
Development and Distribution of PhantomRaven
According to CrowdStrike’s Counter Adversary Operations, the malware was likely crafted using a large language model (LLM). This conclusion is based on detailed analysis, including verbose comments, placeholder code, and statistical patterns within the code. PhantomRaven was initially identified by Koi Security and DCODX in late October 2025, highlighting a campaign involving over 100 malicious npm packages designed to steal authentication tokens, CI/CD secrets, and GitHub credentials.
These packages act as a conduit to fetch a remote dynamic dependency (RDD) from an external server, making it difficult for security tools to detect the libraries as threats. Once operational, the malware scans developer environments for email addresses, collects CI/CD environment data, and gathers system fingerprints, including public IP addresses, all of which are sent to a server controlled by the attacker.
Impact on Software Supply Chain
The malware is also capable of obtaining runtime details, dates, times, and user information from Git/npm configurations, along with CI/CD environment variables for platforms like GitHub Actions, GitLab CI, Jenkins, and CircleCI. CrowdStrike’s recent findings reveal that the threat actor has been active since November 2022, posing as a bug bounty hunter and claiming to have earned rewards from at least nine different organizations in sectors such as technology, retail, and hospitality.
No stolen data from this malware has been found on stealer log markets, suggesting that the attacker uses the stolen information solely to find bug bounty opportunities. Two npm accounts associated with the attacker, used to distribute PhantomRaven, are now inaccessible.
Expanding Operations and Future Threats
Additional online aliases linked to this operation include jpd12, jpd13, npmhell, and others. In August 2025, the threat actor reportedly discovered a remote code execution (RCE) vulnerability through a malicious npm package they released. This was achieved by compromising a target machine and executing a preinstall script to enable RCE.
Furthermore, there is evidence that the threat actor attempted to extend their operations to the Python Package Index (PyPI) repository with similar malware. The use of a large language model to develop PhantomRaven emphasizes the growing trend of cybercriminals leveraging AI technologies to streamline their malicious activities.
CrowdStrike noted that while many cybercriminals rent or develop their own proprietary malware, this particular actor has likely created PhantomRaven to infiltrate company systems and use these breaches to claim rewards from legitimate disclosure programs.
