CrowdStrike: PhantomRaven npm stealer almost certainly LLM-generated (bug-bounty operator)
CrowdStrike Counter Adversary Operations (blog 15 September 2026; THN wire 18 September) details PhantomRaven, a JavaScript information stealer distributed via typosquatted npm packages that use remote dynamic dependencies (HTTP URL deps + preinstall) to fetch the payload. High-confidence assessment that the code was LLM-generated (verbose redundant comments, placeholder WebSocket URL wss://yourserver.com/socket, statistical token patterns). Operator profiled as a self-described bug bounty hunter active since November 2022 (Bugcrowd/Intigriti/YesWeHack/HackenProof/HackerOne claims); CrowdStrike has not seen PhantomRaven logs on stealer shops and assesses stolen CI/CD and developer data is used to find bounty opportunities rather than sell logs. Harvests OS/host/IP, Git/npm emails, and CI/CD env vars (GitHub Actions, GitLab CI, Jenkins, CircleCI). Example packages cited: transform-jsbi-to-bigint, sort-imports-es6-autofix; C2 domains include npm.jpartifacts.com and related *.storeartifact.com / *.storageartifact.com. Mitigations: private npm registry, npm --ignore-scripts / install-scripts controls, upgrade npm (v12+ blocks dependency install scripts by default). Primary: CrowdStrike blog; wire: THN.
- Product
- npm supply chain / Node.js developer and CI/CD environments
- Versions
- n/a (malware family; npm packages rotate)
- Exploited in Australia?
- unknown
- Patch to
- Prefer private registry; default --ignore-scripts / npm install-scripts allowlisting; upgrade npm to versions that block dependency preinstall by default; educate on dependency confusion and typosquat installs
Primary: CrowdStrike — PhantomRaven LLM-generated npm stealer (15 Sep 2026) · The Hacker News — PhantomRaven / LLM bug-bounty operator (18 Sep 2026)