2026-09-17 · view entry permalink →
PhantomRaven: CrowdStrike attributes an LLM-generated npm infostealer, hidden from registry scanners via a remote-URL dependency trick, to a self-described bug-bounty hunter
CrowdStrike Counter Adversary Operations attributes PhantomRaven, an npm information stealer, to a single financially motivated actor who publicly describes themself as a bug-bounty hunter and has been active since November 2022 (CrowdStrike, 2026-09-16). CrowdStrike assesses with high confidence that the malware's code is LLM-generated, based on verbose per-symbol comments explaining the obvious, placeholder code, and statistical token-analysis patterns consistent with an LLM token stream (CrowdStrike, 2026-09-16). The actor distributes the stealer through typosquatted npm packages whose visible code is trivial and non-malicious, but whose package.json specifies a dependency via a raw HTTP URL rather than a normal registry reference, a Remote Dynamic Dependency that npm fetches silently at install time from attacker-controlled infrastructure, so the real payload never appears in the registry's own web interface or most automated scanners. The fetched payload registers as a preinstall script that auto-executes on npm install; CrowdStrike credits npm 12's June 2026 default block on unapproved preinstall scripts with narrowing this vector going forward (CrowdStrike, 2026-09-16).
Once running, the stealer harvests host/OS information, local and external IP addresses, Node.js version, the current working directory and process ID, Git- and npm-configured usernames and emails, and CI/CD environment variables covering GitHub Actions, GitLab CI, Jenkins and CircleCI, tokens, project IDs and build URLs consistent with harvesting CI/CD account credentials rather than end-user secrets. Exfiltration goes out over both HTTP GET and POST to the same command-and-control domains, and the code also carries an incomplete fallback WebSocket exfiltration path CrowdStrike reads as unfinished, redundant infrastructure rather than a live channel. CrowdStrike correlated npm usernames, an X account, a HackerOne-referencing alias, a GitHub account and a rejected 2025 PyPI submission back to the same operator, who publicly claims via their own X profile to have collected bounties from at least nine organizations across tech, retail and hospitality via Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne, using compromises their own malware enabled as leverage for disclosure submissions (CrowdStrike, 2026-09-16). The malware family itself and its Remote Dynamic Dependency technique were first documented by Koi Security, whose original wave affected 126+ packages with over 86,000 downloads (Endor Labs, 2026-03-10, citing Koi Security); Endor Labs' own follow-up research identified three further waves totalling 88 more packages between November 2025 and February 2026 (Endor Labs, 2026-03-10). CrowdStrike's new contribution is the actor-identification and monetization-motive finding.
Triage: a legitimate build tool's own telemetry or update-check call is the benign lookalike; the discriminators are the absence of any corresponding, expected package purpose for the network call and a destination domain pattern that is freshly registered or "artifact"/"registry"-themed rather than a known vendor telemetry endpoint.
PhantomRaven is a simple JS information stealer that exfiltrates system information and continuous integration/continuous deployment (CI/CD)-related environment variables, likely in an attempt to collect account credentials. The code was almost certainly LLM-generated, and the author's technical sophistication is likely low.
In npm version 12 or later, if a developer attempts to install a dependency package with a preinstall script, they receive a warning message indicating that the script has been blocked and will not automatically execute.