{"slug": "phantomraven-an-llm-generated-information-stealer-developed-for-bug-bounty", "title": "PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting", "summary": "CrowdStrike Counter Adversary Operations identified a threat actor behind PhantomRaven, an LLM-generated information stealer distributed through typosquatted npm packages that use remote dynamic dependency links to the domain npm[.]jpartifacts[.]com for command and control, according to a CrowdStrike report. The actor, linked to GitHub and PyPI accounts and the email jpdtester01@gmail[.]com, was accused by a PyPI organization member of building an information stealer after submitting a GitHub issue in February 2025 asking why their code failed to upload; the main project was removed but associated Python files remain accessible. npm released a new version in June 2026 that blocks preinstall scripts in dependency packages unless developers explicitly allow them, with npm version 12 or later warning developers when such scripts are blocked.", "body_md": "The usernames `jpdhellonpm1` and `jpd15` are similar to usernames that industry sources associate with *PhantomRaven* deployments using malicious npm packages. These usernames include `jpd12`, `jpd13`, `npmhell`, `npmpackagejpd`, `npmtestdharsh`, `jpdhackerone11`, and `packagedharsh`.<sup>1</sup> Two of these monikers contain characters that appear in the threat actor’s name, X account username, and email address, the latter of which has been used to contact potential victims. Moreover, the username `jpdhackerone11` references HackerOne, a platform that the threat actor claims they use to manage their bug submissions and payments.\n\nnpm profiles associated with `jpdhellonpm1` and `jpd15` have published packages containing files that include remote dynamic dependency (RDD) links to the domain `npm[.]jpartifacts[.]com`. November 2025 *PhantomRaven* incidents leveraged this domain for command and control (C2).\n\nIn August 2025, the threat actor claimed to have discovered a remote code execution (RCE) vulnerability via a malicious npm package they published. The threat actor explained that they had compromised the target machine and executed their `preinstall` script, which purportedly allowed them to achieve RCE. While CrowdStrike Counter Adversary Operations could not verify this claim, a November 2025 *PhantomRaven* campaign exhibited similar techniques.\n\nIn December 2025, CrowdStrike Counter Adversary Operations identified the threat actor’s GitHub account. In February 2025, the threat actor used this account to submit a GitHub issue on PyPI, asking why their code failed to upload to PyPI. A member of the PyPI organization replied that PyPI does not allow projects with names that are similar to existing or deleted projects (a policy consistent with preventing dependency-confusion attacks) and further accused the threat actor of attempting to build an information stealer.\n\nAs evidence of their accusations, the PyPI organization member provided a link to the threat actor’s main project, which was subsequently removed from the platform. However, multiple associated Python files currently remain accessible. Analysis of these files reveals they contain code for an information stealer similar to *PhantomRaven*. However, unlike previously identified *PhantomRaven* samples that leverage JS and npm, this tool uses Python and PyPI. One analyzed Python file contains metadata, including the email address `jpdtester01@gmail[.]com`; industry sources associate this username with *PhantomRaven*.<sup>2</sup>\n\n## Infection Vector\n\nThe threat actor distributes the malware via typosquatted npm packages that contain minimal, non-malicious code; typically, a simple `Hello, world!` script. However, the packages also specify a dependency via an HTTP URL rather than a standard npm package reference. At installation, npm fetches this remote dependency from attacker-controlled infrastructure; the returned package is the *PhantomRaven* payload.\n\nThe fetched malicious package includes a `preinstall` script<sup>3</sup> that automatically executes during installation. In June 2026, npm released a new version of its package manager to prevent `preinstall` scripts from executing in packages when included as a dependency unless the developer explicitly allows this activity.<sup>4</sup>\n\nIn npm version 12 or later, if a developer attempts to install a dependency package with a `preinstall` script, they receive a warning message indicating that the script has been blocked and will not automatically execute. Only after the developer explicitly approves the `preinstall` script does it execute. Figure 3 shows what developers see when the `preinstall` script is blocked and presented for the developer’s inspection.\n\n```\nDeveloper’s Project Run via npm install Command\nadded 1 package, and audited 3 packages in 148ms\n\nfound 0 vulnerabilities\nnpm warn install-scripts 1 package had install scripts blocked because they are not covered by allowScripts:\nnpm warn install-scripts   [developer-project-package]@1.0.0 (preinstall: node index.js)\nnpm warn install-scripts\nnpm warn install-scripts Run `npm install-scripts ls` to review, or `npm install-scripts approve <pkg>` to allow.\n\nMalicious Project Run via npm install-scripts ls Command\n1 package has install scripts blocked because they are not covered by allowScripts:\n  [typosquatted/malicious-package]@1.0.0 (preinstall: node index.js)\n\nRun `npm install-scripts approve <pkg>` to allow, or `npm install-scripts deny <pkg>` to deny.\n```\n\n*Figure 3. Installation messages displayed to developer in npm version 12 or later*\n\n## Technical Overview\n\n*PhantomRaven* is a simple JS information stealer that exfiltrates system information and continuous integration/continuous deployment (CI/CD)-related environment variables, likely in an attempt to collect account credentials. The code was almost certainly LLM-generated, and the author’s technical sophistication is likely low.\n\nThe malware collects the following information (Table 1).\n\nTable 1. Information collected by PhantomRaven\n| **Category** | **Information Collected** | \n| **System information** | Operating system (OS) | \n| Architecture | \n| Hostname | \n| Local and external IP addresses | \n| **Process and runtime details** | Current directory | \n| Current process ID | \n| NodeJS version | \n| Command-line arguments | \n| Environment variables | \n| **User ID** | Username and email addresses from Git/npm configurations | \n| **Timestamp** | Current date and time | \n| **CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI** | The CI/CD variables include the following: `BUILD_TAG` `BUILD_URL` `CI_NAME` `CI_PROJECT_ID` `CI_PROJECT_NAME` `CI_PROJECT_PATH` `CI_SERVER_NAME` `CI_SERVER_VERSION` `CI_SERVER` `CI` `CIRCLE_BUILD_URL` `CIRCLE_PROJECT_REPONAME` `CIRCLE_USERNAME` `CIRCLECI` `GITHUB_ACTION` `GITHUB_ACTIONS` `GITHUB_ACTOR` `GITHUB_REPOSITORY` `GITHUB_RUN_ID` `GITHUB_WORKFLOW` `GITLAB_CI` `HOME` `JENKINS_URL` `JOB_NAME` `LOGNAME` `npm_config_registry` `npm_package_name` `npm_package_version` `PATH` `USER` | \n\nTo determine the current external IP address of the system on which the malware is executing, *PhantomRaven* contacts `https[:]//api64[.]ipify[.]org?format=json`. After this request has concluded (regardless of success), the malware exfiltrates all collected information via HTTP `GET` and `POST` requests.\n\nThe `GET` request encodes the data as a query string parameter while the `POST` request serializes the data as JSON before placing it in the `POST` body. For the `POST` method, *PhantomRaven* uses the very minimal user-agent string `Mozilla/5.0 (Windows NT 10.0; Win64; x64)`. The user agent is valid but misses many common elements, including browser type and version.\n\n*PhantomRaven*’s code also contains an incomplete fallback WebSocket exfiltration method. However, the code’s hardcoded exfiltration URL is `wss[:]//yourserver[.]com/socket` — highly likely a placeholder and not malicious infrastructure.\n\n#### LLM-Generated Code Characteristics\n\n*PhantomRaven*’s code was almost certainly LLM-generated. This assessment is made with high confidence based on statistical token-analysis patterns as well as verbose comments and placeholder code, which indicate the text is highly consistent with a generated LLM token stream. LLM generation explains several unusual design choices, including exfiltrating data via both HTTP `POST` and `GET` requests.\n\nFigure 4 shows a heavily abridged rendering of the source code’s topmost structure and associated comments. In this code snippet, the marker `/.../` indicates an omission; all comments starting with `//` are present in *PhantomRaven*’s code as shown. The code includes a comment before every global variable and function definition, despite obvious redundancy between the comment’s explanation and the defined symbol’s name.\n\n``` js\nconst os = require(\"os\");\nconst https = require(\"https\");\nconst fs = require(\"fs\");\nconst path = require(\"path\");\n\n// Function to detect user email from various sources\nfunction detectUserEmail() {\n    /*...*/\n}\n\n// Collect CI/CD and Environment Information\nconst ciEnvVars = {\n    /*...*/\n};\n\n// Collect System Information\nconst systemInfo = {\n    /*...*/\n};\n// Fetch public IP dynamically\nhttps.get(/*...*/, (res) => {\n    /*...*/\n}).on(\"error\", () => sendData(systemInfo));\n\n// List of endpoints\nconst endpoints = {\n    /*...*/\n};\n\n// Get available endpoint\nfunction getEndpoint(type = 'log') {\n    /*...*/\n}\n// Convert system info to query string\nfunction buildQueryParams(data) {\n    /*...*/\n}\n\n// New function to lookup systems by email\nasync function lookupByEmail(email) {\n    /*...*/\n}\n\n// Send Data (GET and POST)\nasync function sendData(data) {\n    /*...*/\n}\n\n// WebSocket Backup (if HTTP requests fail)\nasync function sendViaWebSocket(data) {\n    /*...*/\n}\n```\n\n*Figure 4. Verbose PhantomRaven code comments*\n\n## Assessment\n\nThis threat actor’s behavior represents an expansion of known eCrime activities. Most criminal actors that CrowdStrike Counter Adversary Operations tracks rent commodity tools or operate their own proprietary malware; however, this threat actor has likely developed their proprietary *PhantomRaven* to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs.\n\neCrime threat actors will likely continue integrating AI-generated tooling into their operations, as these tools reduce technical barriers to participating in eCrime activity and accelerate tool creation. This assessment is made with moderate confidence based on the observed *PhantomRaven* deployment, as well as deployment of multiple likely AI-generated tools by several big game hunting (BGH) adversaries, including a TRAVELING SPIDER *INC* affiliate and PUNK SPIDER, who deployed AI-generated PowerShell (PS) scripts for operations throughout late 2025 and early 2026.\n\n## Recommendations\n\nThese recommendations can be implemented to help protect against the activity described in this report:\n\n- Consider implementing a private npm registry (where package installations can be controlled, blocked, and monitored) rather than using the official npm registry\n- Configure npm to use `--ignore-scripts` by default, and selectively enable script execution only for trusted packages<sup>5</sup>\n- Update npm to the latest version to restrict `preinstall` and`postinstall` script execution by default\n- Educate users on dependency-confusion attacks that exploit npm’s dependency resolution to deliver malicious packages\n- Use `npm audit` for known vulnerabilities and problems\n\nTable 2 details the tactics and techniques described in this blog post.\n\nTable 2. PhantomRaven tactics and techniques aligned with the MITRE ATT&CK® framework\n| **Tactic** | **Technique** | **Observable** | \n| **Reconnaissance** | T1016.001 - System Network Configuration Discovery: Internet Connection Discovery | *PhantomRaven* contacts`https[:]//api64[.]ipify[.]org` to determine the infected system’s external IP address | \n| **Resource Development** | T1583.001 - Acquire Infrastructure: Domains | The threat actor registered and operated multiple domains for C2 infrastructure, including `packages[.]storeartifact[.]com` ,`registry[.]storageartifact[.]com` , and`npm[.]jpartifacts[.]com` | \n| T1587.001 - Develop Capabilities: Malware | The threat actor developed *PhantomRaven* , likely using an LLM to generate the JS code | \n| **Initial Access** | T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools | The threat actor published typosquatted npm packages that fetched malicious dependencies via HTTP URLs during installation, exploiting the npm supply chain | \n| **Execution** | T1059.007 - Command and Scripting Interpreter: JavaScript | *PhantomRaven* executes as JS code within the NodeJS runtime environment | \n| T1072 - Software Deployment Tools | *PhantomRaven* leverages npm’s`preinstall` script functionality to automatically execute during package installation | \n| **Defense Evasion** | T1027.009 - Obfuscated Files or Information: Embedded Payloads | The threat actor embedded malicious payloads behind HTTP URL dependencies that are not displayed in npm’s web interface | \n| T1036.005 - Masquerading: Match Legitimate Name or Location | Typosquatted package names mimic legitimate development tools and libraries (e.g., `transform-jsbi-to-bigint` and`sort-imports-es6-autofix` ) | \n| **Credential Access** | T1552.001 - Unsecured Credentials: Credentials In Files | *PhantomRaven* searches Git and npm configuration files for email addresses and credentials | \n| T1552.007 - Unsecured Credentials: Container API | The malware collects CI/CD-related environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI that may contain authentication tokens and API keys | \n| **Discovery** | T1082 - System Information Discovery | *PhantomRaven* collects OS type, architecture, hostname, NodeJS version, process ID, and current working directory | \n| T1083 - File and Directory Discovery | *PhantomRaven* searches for and reads`package.json` files, Git configuration files, and npm configuration files | \n| T1614.001 - System Location Discovery: System Language Discovery | *PhantomRaven* collects system location and time zone information | \n| **Collection** | T1005 - Data from Local System | *PhantomRaven* collects system information, environment variables, and configuration files from the infected system | \n| T1119 - Automated Collection | All data collection and exfiltration are performed automatically upon malware execution, without user interaction | \n| **Command and Control** | T1071.001 - Application Layer Protocol: Web Protocols | *PhantomRaven* uses HTTP`GET` and`POST` requests to communicate with C2 infrastructure | \n| T1104 - Multi-Stage Channels | The malware includes both HTTP-based exfiltration and an unfinished WebSocket fallback method for redundant C2 communication | \n| **Exfiltration** | T1041 - Exfiltration Over C2 Channel | Collected data is exfiltrated to the threat actor’s C2 servers via HTTP `GET` and`POST` requests | \n\n## Indicators of Compromise (IOCs)\n\nTable 3. PhantomRaven IOCs\n| **IOCs** | **Description** | \n| `packages[.]storeartifact[.]com` `registry[.]storageartifact[.]com` `packages[.]storageartifact[.]com` `npm[.]jpartifacts[.]com` | C2 domains | \n| `54.173.15[.]59` | C2 IP address | \n| `c31831d47fcbf52ff1f4e61838611916a4276d005a564e69946d5dac04235eed` `95a7dcc6de46826b22c43bee7fc550f3b5e2e6cbc5f33b0c241faf523641cf63` `db3fe46df0a65fe9f8c99d2e11126a032a72e9814e354ce017448ce088a01e02` | *PhantomRaven* SHA256 hashes | \n\n#### Additional Resources", "url": "https://wpnews.pro/news/phantomraven-an-llm-generated-information-stealer-developed-for-bug-bounty", "canonical_source": "https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/", "published_at": "2026-09-30 06:48:48.007441+00:00", "updated_at": "2026-09-30 06:48:50.274869+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-tools"], "entities": ["CrowdStrike", "PhantomRaven", "npm", "PyPI", "GitHub", "HackerOne", "jpdhellonpm1", "jpd15"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/phantomraven-an-llm-generated-information-stealer-developed-for-bug-bounty", "markdown": "https://wpnews.pro/news/phantomraven-an-llm-generated-information-stealer-developed-for-bug-bounty.md", "text": "https://wpnews.pro/news/phantomraven-an-llm-generated-information-stealer-developed-for-bug-bounty.txt", "jsonld": "https://wpnews.pro/news/phantomraven-an-llm-generated-information-stealer-developed-for-bug-bounty.jsonld"}}