CrowdStrike: npm stealer PhantomRaven likely AI-written

The npm supply chain attack behind the PhantomRaven information stealer was most likely written with the help of a large language model, according to an analysis by CrowdStrike's Counter Adversary Operations published this week. npm is the public library where JavaScript developers download ready made pieces of code, called packages, and an attack through it abuses the trust developers place in that library. CrowdStrike said it reached that assessment with high confidence, pointing to verbose comments, placeholder code (sections of a program left unfinished) and statistical token analysis patterns, which examine how code was written rather than what it does. The company describes the operation as financially motivated.

An information stealer is a type of malware that copies private data such as passwords, access keys and session information from a computer and sends it to whoever controls it. PhantomRaven was first flagged by Koi Security and DCODX in late October 2025, when they called attention to a campaign in which more than 100 malicious packages were uploaded to npm to steal authentication tokens, CI/CD secrets and GitHub credentials from developers' machines. According to CrowdStrike, the campaign combined slopsquatting with typosquatting. Typosquatting means publishing a package whose name looks almost identical to a popular one, so a developer installs the wrong thing by mistake. Slopsquatting means registering a name that an AI coding tool might invent when it suggests a package that does not actually exist.

The packages themselves were only the cover. Instead of carrying the stealing code, they fetched a remote dynamic dependency, meaning code downloaded from an outside server after installation, so that the libraries sitting in the registry would not be flagged by security tools. Once running, that remote code scanned the developer environment for email addresses, gathered information about the CI/CD environment (the automated pipeline that builds, tests and releases software), and collected a system fingerprint that included the public IP address. It then transmitted the results to a server controlled by the attacker. The malware was also built to collect runtime details, the current date and time, the username and the email addresses stored in Git and npm configurations, and the CI/CD environment variables used by GitHub Actions, GitLab CI, Jenkins and CircleCI. Those variables frequently hold the keys and tokens that let a build system publish code, deploy a site or reach a cloud account.

CrowdStrike's latest findings say the actor behind the operation has been active since November 2022 and claims to be a bug bounty hunter who has collected rewards from at least nine organisations in the technology, retail and hospitality sectors. Bug bounty programmes pay people who responsibly report security flaws. The company said it has not observed information stolen by this malware turning up on stealer log shops, the marketplaces where stolen credentials are traded, which in its view suggests the operator likely uses the information stealer solely to identify bug bounty opportunities. CrowdStrike contrasted that with the usual pattern, in which criminal actors rent off the shelf tools or run their own malware, and said this actor appears to have built PhantomRaven itself to compromise company assets and then used those compromises as leverage when claiming rewards from established disclosure programmes.

At least two npm accounts maintained by the operator were observed pushing packages that carried PhantomRaven: jpdhellonpm1, linked to a package named transform-jsbi-to-bigint, and jpd15, linked to one named sort-imports-es6-autofix. Both npm accounts are no longer accessible. Other online identities linked to the same operation include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11 and packagedharsh.

Security researcher Maddie Stewart also noted that in August 2025 the actor claimed to have discovered a remote code execution (RCE) vulnerability through a malicious npm package they had published. RCE means being able to run your own commands on somebody else's machine. According to that account, the actor said they had compromised the target machine and executed their preinstall script, a small piece of code that runs automatically during installation, which they said allowed them to achieve RCE.

There is more. Evidence has emerged that the same actor tried to push packages to the Python Package Index (PyPI), Python's equivalent of npm, containing code for an information stealer that shows similarities with PhantomRaven. CrowdStrike notes that the likely use of a large language model underlines how threat actors are increasingly adopting the technology, compressing the time and effort such campaigns take. For website owners and IT teams, the practical question is where the risk sits. Code that runs during installation can reach the same secrets a build pipeline uses to publish a site, so even the copy of a project that never touches production deserves attention.

That is also why a periodic review of how software is built and deployed is worthwhile. AEU-I, our security-first IT, infrastructure and consulting service, is one place to start for teams that want help examining exactly that. Until then the basics hold: know what your project depends on, and replace the keys it uses if anything turns out to have been tampered with.