PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting

PhantomRaven (TL-2026-2531) is a high-severity supply-chain compromise, first published 2026-09-16. It is attributed to JPD with medium confidence, affects npm, Inc. / OpenJS Foundation npm CLI / npm registry (preinstall, maps to 14 MITRE ATT&CK techniques (T1005, T1033, T1036.005), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-2531

Threat ID
TL-2026-2531
Severity
HIGH
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-09-16
Last reviewed
2026-09-16
Attribution
JPD
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
technology, retail, hospitality, software development, devops
Detection rules
9
Indicators of compromise
25

Malware and tooling in PhantomRaven

Malware and tooling: PhantomRaven

CrowdStrike attributed PhantomRaven, a JavaScript information stealer distributed via typosquatted/impersonated npm packages using Remote Dynamic Dependencies (RDD) to hide payloads off-registry, to a self-described bug bounty hunter operating under the 'JPD' handle since November 2022. Across at least four campaign waves (August 2025-February 2026, 200+ packages, 86,000+ downloads), the malware harvested Git/npm credentials and CI/CD secrets from GitHub Actions, GitLab CI, Jenkins, and CircleCI to fund bounty submissions to at least nine organizations.

How PhantomRaven works

PhantomRaven is a JavaScript-based information stealer distributed through the npm registry via typosquatted and slopsquatted package names (e.g., transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, and impersonations of Adobe, Airbnb, GitLab, and Apache tooling). The wrapper packages advertise zero dependencies but embed a package.json dependency field pointing to an HTTP(S) URL on attacker-controlled infrastructure rather than a standard registry reference -- a technique researchers term Remote Dynamic Dependencies (RDD). When a developer or CI/CD pipeline runs `npm install`, npm silently fetches the remote tarball, which ships a `preinstall` lifecycle script that executes automatically (npm < 12) without a visible dependency entry in the npm web UI, defeating static registry scanning.

The executed payload (a ~259-line index.js, near-identical across waves) fingerprints the host (OS, hostname, architecture, Node.js version, public IP), harvests developer identity from `.gitconfig`, `.npmrc`, `package.json`, and environment variables, and specifically targets CI/CD indicators and secrets from GitHub Actions (`GITHUB_ACTIONS`), GitLab CI (`GITLAB_CI`), Jenkins (`JENKINS_URL`), and CircleCI, along with `npm_config_registry` and authentication tokens. Exfiltration is triple-redundant: HTTP GET, HTTP POST, and an incomplete WebSocket fallback (hardcoded to a placeholder `wss://yourserver.com/socket`) to attacker C2 domains.

CrowdStrike, building on Koi Security's initial October 29, 2025 disclosure (126+ packages) and Sonatype's follow-on identification of 83 more packages on October 31, 2025, tracked at least four infrastructure waves through February 2026, each rotating a newly registered C2 domain (all registered via Amazon Registrar with AWS Route53 nameservers and WHOIS privacy) while reusing the same payload logic and 'JPD' author-field artifact. CrowdStrike attributes the campaign to a financially motivated individual active as a bug bounty hunter since November 2022, correlating the 'JPD' username pattern across 50+ rotated npm publisher accounts, a GitHub account identified in December 2025, and the email jpdtester01@gmail.com (also used in a rejected February 2025 PyPI submission attempt), claiming payouts from at least nine victim organizations across technology, retail, and hospitality via Bugcrowd, Intigriti, YesWeHack, HackenProof, and HackerOne. Code-quality indicators -- verbose redundant comments, placeholder logic, and statistical token patterns -- led CrowdStrike to assess the malware as almost certainly LLM-generated. npm registry version 12 (released June 2026) mitigates the preinstall vector by requiring explicit developer approval before any preinstall script executes.

MITRE ATT&CK techniques used in TL-2026-2531

Collection

T1005 Data from Local System

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1552.001 Credentials In Files

Resource Development

T1583.001 Domains; T1585 Establish Accounts; T1608.001 Upload Malware

Affected products and versions in PhantomRaven

  • npm, Inc. / OpenJS Foundation — npm CLI / npm registry (preinstall lifecycle script execution)
    Vulnerable versions: npm CLI versions prior to 12 (preinstall scripts execute automatically without developer approval)
    Fixed in: npm CLI 12 and later (preinstall script execution requires explicit developer approval)
  • Malicious npm publishers ('JPD' accounts) — Typosquatted/impersonating npm packages (e.g. transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, adobe-alloy, airbnb-babel, and 200+ others across four waves)
    Vulnerable versions: All published versions of identified PhantomRaven packages
    Fixed in: Packages removed/unpublished from npm registry following disclosure

Remediation for PhantomRaven

Patches

  • Upgrade to npm registry/CLI version 12 or later, which requires explicit developer approval before any preinstall lifecycle script executes

Immediate actions

  • Audit package.json / package-lock.json across all repositories for dependency entries pointing to HTTP(S) URLs instead of registry references (the Remote Dynamic Dependency indicator)
  • Rotate all Git, npm, and CI/CD secrets (GitHub Actions, GitLab CI, Jenkins, CircleCI tokens) on any system that installed a known PhantomRaven package, per the GHSA-mm3f-jjww-x883 guidance
  • Block outbound traffic to known PhantomRaven C2 domains and IPs (npm.jpartifacts.com, packages.storeartifact.com, package.storeartifacts.com, npm.artifactsnpm.com, registry.storageartifact.com, packages.storageartifact.com, 54.173.15.59, 100.26.42.247, 13.219.250.107, 54.227.45.171)
  • Search CI/CD build logs and install history for the identified malicious package names and the SHA256 payload hashes

Workarounds

  • Disable automatic lifecycle script execution with `npm install --ignore-scripts` in CI/CD environments until npm 12+ is adopted
  • Pin dependencies to exact, previously-audited versions and disallow unreviewed new package additions in build pipelines

Longer-term hardening

  • Adopt Software Composition Analysis (SCA) tooling that flags URL-based/RDD dependencies rather than relying on registry-published tarball scanning alone
  • Enforce lockfile integrity checks and disallow non-registry dependency sources in CI/CD pipeline policy
  • Run CI/CD builds with least-privilege, short-lived, scoped tokens so a compromised preinstall script cannot exfiltrate durable credentials
  • Monitor for newly registered lookalike npm accounts and packages impersonating internally used dependency names

Weaknesses (CWE) in PhantomRaven

CWE-506, CWE-829, CWE-494

Timeline of PhantomRaven

  • Threat actor begins operating as a self-described bug bounty hunter under the 'JPD' handle pattern, per CrowdStrike attribution timeline.
  • PhantomRaven Wave 1 malicious npm packages begin publishing to the registry, later found to have accumulated over 86,000 downloads before discovery.
  • Wave 1 C2 domain packages.storeartifact.com (54.173.15.59) registered via Amazon Registrar, marking the start of PhantomRaven infrastructure.
  • Koi Security publicly discloses the initial PhantomRaven campaign, identifying 126+ malicious npm packages using the Remote Dynamic Dependency technique.
  • Sonatype identifies an additional 83 malicious PhantomRaven-linked npm packages.
  • Wave 2 C2 domain npm.jpartifacts.com (100.26.42.247) registered, rotating infrastructure after Wave 1 exposure.
  • PhantomRaven Wave 2 activity observed live by CrowdStrike, including an attempted victim-contact incident.
  • Researchers identify a GitHub account linked to the 'JPD' actor persona.
  • PhantomRaven Wave 3 begins using C2 domain package.storeartifacts.com (13.219.250.107).
  • PhantomRaven Wave 4 begins using C2 domain npm.artifactsnpm.com (54.227.45.171); combined Waves 3-4 add 88 new malicious packages.
  • NowSecure publishes technical analysis of the Remote Dynamic Dependency mechanism used across PhantomRaven waves.
  • GitHub Security Advisory GHSA-mm3f-jjww-x883 / OSV MAL-2026-1552 published for the malicious typescript-nhost package, advising credential rotation for any installer.
  • npm registry version 12 released, requiring explicit developer approval before any preinstall lifecycle script executes, closing the primary PhantomRaven infection vector.
  • CrowdStrike publishes attribution linking PhantomRaven to the 'JPD' actor and jpdtester01@gmail.com, and details bounty claims against at least nine victim organizations.

Sources cited for PhantomRaven

More in supply chain

Detection coverage for TL-2026-2531

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2531 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2531

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats