npm stealer tied to bounty hunter

A developer who claims to hunt bugs for bounty money may have spent the last several years building and shipping a JavaScript information stealer through the npm package registry. CrowdStrike's Counter Adversary Operations unit said the author of the malware, tracked as PhantomRaven, most likely wrote it with a large language model, citing verbose comments, placeholder code, and statistical token-analysis patterns in the sample.

The assessment adds a new data point to a supply chain campaign that security researchers first started pulling apart in late 2025, when more than 100 malicious packages turned up on npm carrying a downloader for a remote dependency hosted outside the registry.

How the packages worked

PhantomRaven was first flagged by Koi Security and DCODX, which described a slopsquatting and typosquatted campaign. The operators uploaded more than 100 malicious packages to npm with the goal of stealing authentication tokens, CI/CD secrets, and GitHub credentials from developers' machines.

The packages did not carry the stealer itself. Instead, they acted as cover for a remote dynamic dependency, or RDD, that the library loaded from an external server. That split let the published package stay relatively clean while the actual payload lived elsewhere, outside the reach of a routine registry scan.

Once the remote dependency was installed and executed, the stealer scanned the developer environment for email addresses, gathered details about the CI/CD setup, and collected a system fingerprint that included the public IP address. It then sent everything back to a server the attacker controlled.

What the stealer collected

The malware's collection routine went beyond basic host reconnaissance. According to CrowdStrike, it gathered runtime details, the current date and time, and the username and email addresses configured in Git and npm, along with CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI.

That combination targets the credentials and configuration data that let a developer or an automated pipeline push code, publish packages, and reach other systems. The environment variables in particular can hold tokens that grant broad access without requiring a password.

The campaign fits the pattern of a software supply chain attack, where the compromise happens through tooling the victim already trusts rather than through a phishing email or a vulnerable internet-facing service.

The LLM fingerprints

CrowdStrike's analysts did not need a recovered prompt to reach their conclusion. They pointed to characteristics of the code itself: unusually verbose comments, placeholder logic left in place, and statistical patterns in how tokens were arranged.

"The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns," CrowdStrike's Counter Adversary Operations said in an analysis published this week.

— CrowdStrike's Counter Adversary Operations

The finding matters because it suggests the author did not need deep malware development experience to assemble a stealer that covers four CI/CD platforms and multiple credential sources. The source material does not say which model was involved or whether any part of the code was hand-edited afterward.

A bounty hunter's cover story

CrowdStrike traced the operation back to November 2022. The person behind it presents as a bug bounty hunter and has collected payouts from no fewer than nine entities across the technology, retail, and hospitality sectors.

The company said it has not seen data stolen by the malware turn up on stealer log shops. In its reading, that points to a specific use for the collected information.

"The operator likely uses the information stealer solely to identify bug bounty opportunities."

— CrowdStrike's Counter Adversary Operations

Maddie Stewart, a security researcher, described an August 2025 episode that fits the same pattern. In that case, the actor claimed to have found a remote code execution flaw through a malicious npm package they had published.

"The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE."

— Maddie Stewart, security researcher

Accounts and handles

At least two npm user accounts tied to the operator were observed pushing packages that contained PhantomRaven. Both were no longer accessible at the time of CrowdStrike's writing.

• jpdhellonpm1 — transform-jsbi-to-bigint
• jpd15 — sort-imports-es6-autofix

Other online identities linked to the same operation include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh.

There is also evidence that the actor tried to push packages to the Python Package Index containing code for an information stealer that shares characteristics with PhantomRaven. The source does not say whether those uploads succeeded or how many packages were involved.

Tooling shift in criminal operations

The likely role of an LLM in generating PhantomRaven is part of a wider change in how these campaigns get built. Producing a multi-platform stealer with repository-specific collection logic takes less time and effort than it once did when the work has to be written by hand.

CrowdStrike drew a contrast between this operator and the typical criminal developer. Most actors in that space rent commodity tools or run their own proprietary malware. This one, in CrowdStrike's account, built PhantomRaven to compromise company assets and then used those compromises as leverage to claim rewards from legitimate disclosure programs.

That framing does not rest on a technical capability alone. It depends on the operator's own claims about bounties collected and on the absence of the stolen data from the marketplaces where credentials usually surface.

What defenders can work with

The technical details CrowdStrike published give defenders a set of concrete artifacts to look for. The remote dynamic dependency pattern is one: a package that downloads additional code at install time from a server outside the registry behaves differently from a self-contained library, and the fetch itself can be observed.

The collection targets are another. Environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI are specific enough that teams can inventory which of their pipelines expose secrets through those variables and how broadly those secrets are scoped.

The two npm package names and the associated account handles are a third. Those identities were already removed from npm, but the handles and the package names remain useful as historical indicators when reviewing logs or scanning for older installs.

Why it matters

The PhantomRaven case suggests that the population of people capable of mounting a supply chain attack may be broader than the pool of skilled malware developers alone. If an LLM can produce a working stealer for GitHub Actions, GitLab CI, Jenkins, and CircleCI, then the barrier that once kept less experienced actors out of this kind of campaign is lower than it used to be.

It also complicates the question of intent. An operator who claims bounties and says the stolen data is used to find vulnerabilities is still collecting credentials from systems they do not own. Companies whose CI/CD secrets were swept up in that process may not be able to rely on the operator's stated motives as a form of protection.

For teams that install packages from public registries, the practical takeaway is that the code and the credentials it can reach deserve scrutiny regardless of how the package presents itself. The source material does not establish how widely PhantomRaven was installed or how many organizations were affected.

Reporting based on original coverage from The Hacker News. CrowdStrike's full analysis is available here.