npm Ecosystem / PhantomRaven — AI-Generated InfoStealer Campaign and Software Supply Chain Attacks (N/A)

Publication date: September 18, 2026
Category: Malware / Cybercrime

Introduction

A recent threat intelligence report published by CrowdStrike has connected a financially motivated threat actor to the creation and distribution of a JavaScript-based information stealer known as PhantomRaven, hosted within the official npm package registry. According to findings, the developer likely authored the malware using a Large Language Model (LLM), an assessment substantiated by verbose comments, placeholder code, and statistical token-analysis patterns. Unlike traditional ransomware groups or cybercrime syndicates, this threat actor poses as a bug bounty hunter, weaponizing stolen corporate credentials to submit fraudulent vulnerability reports across multiple technology entities.

What is PhantomRaven? (General Analysis)

PhantomRaven is an information-stealing malware tailored for developer environments, engineered to harvest authentication tokens, CI/CD integration secrets, and repository credentials directly from developer workstations.

The hallmark of this threat lies in the combination of typosquatting and slopsquatting techniques—publishing malicious packages disguised as legitimate developer libraries to trick users during dependency resolution. To bypass automated static security scans, these packages utilize remote dynamic dependency (RDD) fetching, downloading the core stealer payload from an attacker-controlled server only upon successful installation in a target environment.

Because this incident involves a software supply chain malware campaign without a formal NVD CVE identifier, the following reasoned estimations are provided based on the nature of the flaw:

  • Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L (Estimated Score: 8.6 - High / Critical)
  • Estimated CWE Classification: CWE-506 (Embedded Malicious Code) / CWE-829 (Inclusion of Functionality from Untrusted Control Sphere)

Estimation Note: The values above are reasoned estimations grounded in the behavior of remote code execution and mass secret harvesting via untrusted dependencies, as no official NVD record exists at the time of this analysis.

How Does It Work? (Technical Analysis)

PhantomRaven’s operational workflow comprises multiple distinct phases aimed at stealthy infiltration and selective intelligence extraction:

  • Initial Infection & Typosquatting Vector: The threat actor publishes decoy libraries to the npm registry (such as jpdhellonpm1/transform-jsbi-to-bigint and jpd15/sort-imports-es6-autofix). When a developer installs the package, an embedded preinstall script executes automatically on the local host.
  • Remote Dynamic Dependency (RDD) Retrieval: To evade static analysis tools inspecting source code uploaded to public registries, the initial package contains only a minimal loader that fetches the primary payload from an external server during runtime execution.
  • Environment Reconnaissance & Secret Harvesting: Once active on the victim machine, the stealer scans the developer environment for:
    • Email addresses and system digital fingerprints (including public IP addresses).
    • CI/CD environment variables associated with GitHub Actions, GitLab CI, Jenkins, and CircleCI.
    • Local Git and npm configurations (usernames, email addresses).
    • Access tokens and credentials stored within configuration files.
  • Data Exfiltration: Gathered intelligence is bundled and transmitted to attacker-controlled infrastructure. Notably, stolen data has not been observed appearing on mainstream stealer log marketplaces, reinforcing the assessment that the operator uses the harvested data strictly to uncover and exploit bug bounty opportunities.

Affected Systems / Environments

The threat directly impacts individual developers, open-source maintainers, and organizations utilizing the npm (Node.js) package manager. Vulnerable environments and targeted infrastructure include:

  • Developer workstations running Node.js runtime environments where package installations take place.
  • Continuous Integration and Continuous Deployment (CI/CD) pipelines: GitHub Actions, GitLab CI, Jenkins, and CircleCI.
  • Sectors indirectly impacted by fraudulent vulnerability disclosures: technology, retail, and hospitality.

Mitigation and Detection

Remediation

  • Dependency Auditing: Utilize Software Composition Analysis (SCA) tools and commands such as npm audit to inspect the integrity and provenance of installed packages.
  • Restrict Automatic Script Execution: Disable automatic installation scripts in npm globally using configuration settings (npm config set ignore-scripts true), manually vetting dependencies requiring pre/post-installation hooks.
  • Immediate Credential Rotation: If compromise by packages associated with this actor (e.g., jpdhellonpm1, jpd15) is suspected, immediately revoke and rotate exposed GitHub tokens, CI/CD secrets, and deployment keys.

Detection

Defensive teams and SOC analysts should monitor audit logs for suspicious package installation patterns and anomalous environment variable access on build servers.

yaml 
title: Detection of Suspicious npm Script Execution (PhantomRaven)
id: 9b8a7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects preinstall script executions associated with remote dynamic dependency (RDD) fetching.
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - 'preinstall'
      - 'transform-jsbi-to-bigint'
      - 'sort-imports-es6-autofix'
  condition: selection
falsepositives:
  - Minimal false positives; requires validation of legitimate packages sharing similar nomenclature.
level: high

Critical Implication: The adoption of generative AI tools by threat actors to write clean, functional malware drastically lowers the barrier to entry, enabling highly persuasive supply chain campaigns that evade casual code reviews.

Wrapping Up

The PhantomRaven campaign highlights the evolution of software supply chain abuse as an intelligence-gathering mechanism for secondary attacks. The use of LLMs to structure clean code, combined with the subterfuge of leveraging bug bounties instead of traditional cybercrime monetization, demonstrates a sophisticated operational model. For the development community and security teams, the lesson is clear: strict dependency validation and tight control over script execution in package managers are indispensable defenses against AI-driven threats.

References