PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting

Key facts for PhantomRaven npm bug bounty stealer

Detection coverage for PhantomRaven npm bug bounty stealer

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2531 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PhantomRaven Remote Dynamic Dependency (RDD) npm Install / Preinstall Script Execution

Detects the PhantomRaven initial-access mechanism: a package.json dependency field pointing to an attacker-controlled HTTP(S) URL instead of a standard registry reference (Remote Dynamic Dependency), fetched during `npm install` and executed via an automatic preinstall lifecycle script on npm CLI < 12. Fires on known PhantomRaven C2 tarball URLs, on the confirmed malicious/typosquatted package names (transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, adobe-alloy, airbnb-babel), and on the generic RDD indicator (an http(s) URL embedded in a dependency field) inside CI/CD build logs.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.001, T1195.002, T1608.001, T1036.005, T1059.007
• Data sources: ci_cd_build_logs (github_actions/gitlab_ci/jenkins/circleci), npm_registry_audit_log, sysmon (process_creation, EventID 1), edr_process_telemetry (DeviceProcessEvents)
• Severity: high
• Confidence: high

Splunk SPL

index=cicd_logs sourcetype IN ("github:actions:workflow_job","gitlab:ci:job","jenkins:build:console","circleci:job")
| rex field=_raw "(?<npm_dep_url>https?:\/\/[a-zA-Z0-9\.\-]+\/[^\s\"']+\.tgz)"
| eval known_c2_domain=if(match(npm_dep_url, "(?i)(npm\.jpartifacts\.com|packages\.storeartifact\.com|package\.storeartifacts\.com|npm\.artifactsnpm\.com|registry\.storageartifact\.com|packages\.storageartifact\.com)"), 1, 0)
| eval known_bad_package=if(match(_raw, "(?i)(transform-jsbi-to-bigint|sort-imports-es6-autofix|typescript-nhost|adobe-alloy|airbnb-babel)"), 1, 0)
| where isnotnull(npm_dep_url) OR known_bad_package=1
| eval detection_reason=case(known_c2_domain=1, "known_phantomraven_c2_rdd_tarball_url", known_bad_package=1, "known_malicious_package_name_match", isnotnull(npm_dep_url), "generic_rdd_indicator_http_url_as_dependency")
| table _time, host, source, sourcetype, npm_dep_url, detection_reason, _raw
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node.exe", "node")
| where InitiatingProcessFileName in~ ("npm.cmd", "npm", "npm-cli.js", "cmd.exe", "sh")
| where ProcessCommandLine has_any ("preinstall", "node_modules")
| extend SuspectPackage = extract(@"node_modules[\\/]([^\\/\s]+)", 1, ProcessCommandLine)
| where SuspectPackage in~ ("transform-jsbi-to-bigint","sort-imports-es6-autofix","typescript-nhost","adobe-alloy","airbnb-babel")
   or ProcessCommandLine has_any ("jpartifacts.com","storeartifact.com","storeartifacts.com","artifactsnpm.com","storageartifact.com")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SuspectPackage
| order by Timestamp desc

Sigma

title: PhantomRaven npm Remote Dynamic Dependency Preinstall Execution
id: e1f7ea48-8a2f-4a1b-9d3e-7c5b6a9f2d10
status: experimental
description: Detects a node.exe process spawned by npm during a preinstall lifecycle step for a package known to use the PhantomRaven Remote Dynamic Dependency technique, or referencing a known PhantomRaven C2/staging domain.
references:
  - https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/
  - https://github.com/advisories/GHSA-mm3f-jjww-x883
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
  - attack.resource-development
  - attack.t1608.001
  - attack.initial-access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.defense-evasion
  - attack.t1036.005
  - attack.tool.phantomraven
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm-cli.js'
      - '\cmd.exe'
  selection_child:
    Image|endswith:
      - '\node.exe'
  selection_context:
    CommandLine|contains:
      - 'preinstall'
      - 'node_modules'
  selection_known_package:
    CommandLine|contains:
      - 'transform-jsbi-to-bigint'
      - 'sort-imports-es6-autofix'
      - 'typescript-nhost'
      - 'adobe-alloy'
      - 'airbnb-babel'
  selection_known_infra:
    CommandLine|contains:
      - 'jpartifacts.com'
      - 'storeartifact.com'
      - 'storeartifacts.com'
      - 'artifactsnpm.com'
      - 'storageartifact.com'
  condition: (selection_parent and selection_child and selection_context) or selection_known_package or selection_known_infra
falsepositives:
  - Legitimate internal packages intentionally pinning a git+https tarball dependency for valid engineering reasons
  - SCA/security tooling scanning package.json files that happens to match the same command-line substrings
level: high

Known false positives:

• Legitimate internal packages intentionally using git+https or tarball URL dependencies for valid engineering reasons (e.g., pinned GitHub release tarballs)
• Security/SCA tooling itself scanning package.json files and matching on similar command-line substrings
• Engineers deliberately re-running the flagged package names in an isolated sandbox as part of incident remediation or malware analysis

Tuning notes: Extend the malicious-package-name list as new PhantomRaven waves rotate names (Wave 5, August 2026, targeted DeFi/cloud/AI dependency names) by pulling current indicators from GHSA-mm3f-jjww-x883 and OSV MAL-2026-1552; tighten the RDD regex to require the string appear within a package.json `dependencies`/`optionalDependencies` block context rather than any bare URL in a log line, to reduce noise from legitimate git+https dependency entries.

• 🔒 PhantomRaven Remote Dynamic Dependency (RDD) npm Install / Preinstall Script Execution · unlock with TL Creds
• 🔒 PhantomRaven Git/npm Credential and CI/CD Secret Harvesting · unlock with TL Creds
• 🔒 PhantomRaven C2 Exfiltration to Known Wave 1-4 Infrastructure · unlock with TL Creds
• 🔒 PhantomRaven Remote Dynamic Dependency (RDD) npm Install / Preinstall Script Execution · unlock with TL Creds
• 🔒 PhantomRaven Git/npm Credential and CI/CD Secret Harvesting · unlock with TL Creds
• 🔒 PhantomRaven C2 Exfiltration to Known Wave 1-4 Infrastructure · unlock with TL Creds
• 🔒 PhantomRaven Git/npm Credential and CI/CD Secret Harvesting · unlock with TL Creds
• 🔒 PhantomRaven C2 Exfiltration to Known Wave 1-4 Infrastructure · unlock with TL Creds

Indicators of compromise for PhantomRaven npm bug bounty stealer

As of 2026-09-16, Threadlinqs Intelligence tracks 25 indicators of compromise for TL-2026-2531.

Sample indicators (3 of 25)

• IP address: 54.173.15[.]59
• Domain: npm[.]jpartifacts[.]com
• File hash: c31831d47fcbf52ff1f4e61838611916a4276d005a564e69946d5dac04235eed

Defanged, TLP:CLEAR. Full set of 25 indicators: unlock with TL Creds.

Community OSINT corroboration for PhantomRaven npm bug bounty stealer

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How PhantomRaven npm bug bounty stealer works

PhantomRaven is a JavaScript-based information stealer distributed through the npm registry via typosquatted and slopsquatted package names (e.g., transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, and impersonations of Adobe, Airbnb, GitLab, and Apache tooling). The wrapper packages advertise zero dependencies but embed a package.json dependency field pointing to an HTTP(S) URL on attacker-controlled infrastructure rather than a standard registry reference -- a technique researchers term Remote Dynamic Dependencies (RDD). When a developer or CI/CD pipeline runs `npm install`, npm silently fetches the remote tarball, which ships a `preinstall` lifecycle script that executes automatically (npm < 12) without a visible dependency entry in the npm web UI, defeating static registry scanning.

The executed payload (a ~259-line index.js, near-identical across waves) fingerprints the host (OS, hostname, architecture, Node.js version, public IP), harvests developer identity from `.gitconfig`, `.npmrc`, `package.json`, and environment variables, and specifically targets CI/CD indicators and secrets from GitHub Actions (`GITHUB_ACTIONS`), GitLab CI (`GITLAB_CI`), Jenkins (`JENKINS_URL`), and CircleCI, along with `npm_config_registry` and authentication tokens. Exfiltration is triple-redundant: HTTP GET, HTTP POST, and an incomplete WebSocket fallback (hardcoded to a placeholder `wss://yourserver.com/socket`) to attacker C2 domains.

CrowdStrike, building on Koi Security's initial October 29, 2025 disclosure (126+ packages) and Sonatype's follow-on identification of 83 more packages on October 31, 2025, tracked at least four infrastructure waves through February 2026, each rotating a newly registered C2 domain (all registered via Amazon Registrar with AWS Route53 nameservers and WHOIS privacy) while reusing the same payload logic and 'JPD' author-field artifact. CrowdStrike attributes the campaign to a financially motivated individual active as a bug bounty hunter since November 2022, correlating the 'JPD' username pattern across 50+ rotated npm publisher accounts, a GitHub account identified in December 2025, and the email jpdtester01@gmail.com (also used in a rejected February 2025 PyPI submission attempt), claiming payouts from at least nine victim organizations across technology, retail, and hospitality via Bugcrowd, Intigriti, YesWeHack, HackenProof, and HackerOne. Code-quality indicators -- verbose redundant comments, placeholder logic, and statistical token patterns -- led CrowdStrike to assess the malware as almost certainly LLM-generated. npm registry version 12 (released June 2026) mitigates the preinstall vector by requiring explicit developer approval before any preinstall script executes.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Discovery

T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location

Execution

T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

Initial Access

T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Credential Access

T1552.001 Credentials In Files

Resource Development

T1583.001 Domains; T1585 Establish Accounts; T1608.001 Upload Malware

Remediation for PhantomRaven npm bug bounty stealer

Patches

• Upgrade to npm registry/CLI version 12 or later, which requires explicit developer approval before any preinstall lifecycle script executes

Immediate actions

• Audit package.json / package-lock.json across all repositories for dependency entries pointing to HTTP(S) URLs instead of registry references (the Remote Dynamic Dependency indicator)
• Rotate all Git, npm, and CI/CD secrets (GitHub Actions, GitLab CI, Jenkins, CircleCI tokens) on any system that installed a known PhantomRaven package, per the GHSA-mm3f-jjww-x883 guidance
• Block outbound traffic to known PhantomRaven C2 domains and IPs (npm.jpartifacts.com, packages.storeartifact.com, package.storeartifacts.com, npm.artifactsnpm.com, registry.storageartifact.com, packages.storageartifact.com, 54.173.15.59, 100.26.42.247, 13.219.250.107, 54.227.45.171)
• Search CI/CD build logs and install history for the identified malicious package names and the SHA256 payload hashes

Workarounds

• Disable automatic lifecycle script execution with `npm install --ignore-scripts` in CI/CD environments until npm 12+ is adopted
• Pin dependencies to exact, previously-audited versions and disallow unreviewed new package additions in build pipelines

Longer-term hardening

• Adopt Software Composition Analysis (SCA) tooling that flags URL-based/RDD dependencies rather than relying on registry-published tarball scanning alone
• Enforce lockfile integrity checks and disallow non-registry dependency sources in CI/CD pipeline policy
• Run CI/CD builds with least-privilege, short-lived, scoped tokens so a compromised preinstall script cannot exfiltrate durable credentials
• Monitor for newly registered lookalike npm accounts and packages impersonating internally used dependency names

Affected and fixed versions

• npm, Inc. / OpenJS Foundation — npm CLI / npm registry (preinstall lifecycle script execution)
  Vulnerable versions: npm CLI versions prior to 12 (preinstall scripts execute automatically without developer approval)
  Fixed in: npm CLI 12 and later (preinstall script execution requires explicit developer approval)
• Malicious npm publishers ('JPD' accounts) — Typosquatted/impersonating npm packages (e.g. transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, adobe-alloy, airbnb-babel, and 200+ others across four waves)
  Vulnerable versions: All published versions of identified PhantomRaven packages
  Fixed in: Packages removed/unpublished from npm registry following disclosure

Timeline of PhantomRaven npm bug bounty stealer

• 2022-11-01 Threat actor begins operating as a self-described bug bounty hunter under the 'locked-ioc-25' handle pattern, per CrowdStrike attribution timeline.
• 2025-08-01 locked-ioc-20 Wave 1 malicious npm packages begin publishing to the registry, later found to have accumulated over 86,000 downloads before discovery.
• 2025-08-07 Wave 1 C2 domain locked-ioc-8 (locked-ioc-19) registered via Amazon Registrar, marking the start of locked-ioc-20 infrastructure.
• 2025-10-29 Koi Security publicly discloses the initial locked-ioc-20 campaign, identifying 126+ malicious npm packages using the Remote Dynamic Dependency technique.
• 2025-10-31 Sonatype identifies an additional 83 malicious PhantomRaven-linked npm packages.
• 2025-11-04 Wave 2 C2 domain locked-ioc-14 (locked-ioc-17) registered, rotating infrastructure after Wave 1 exposure.
• 2025-11-13 locked-ioc-20 Wave 2 activity observed live by CrowdStrike, including an attempted victim-contact incident.
• 2025-12-01 Researchers identify a GitHub account linked to the 'locked-ioc-25' actor persona.
• 2026-02-13 locked-ioc-20 Wave 3 begins using C2 domain locked-ioc-9 (locked-ioc-16).
• 2026-02-18 locked-ioc-20 Wave 4 begins using C2 domain locked-ioc-13 (locked-ioc-18); combined Waves 3-4 add 88 new malicious packages.
• 2026-03-13 NowSecure publishes technical analysis of the Remote Dynamic Dependency mechanism used across locked-ioc-20 waves.
• 2026-03-16 GitHub Security Advisory GHSA-mm3f-jjww-x883 / OSV MAL-2026-1552 published for the malicious locked-ioc-15 package, advising credential rotation for any installer.
• 2026-06-01 npm registry version 12 released, requiring explicit developer approval before any preinstall lifecycle script executes, closing the primary locked-ioc-20 infection vector.
• 2026-09-15 CrowdStrike publishes attribution linking locked-ioc-20 to the 'locked-ioc-25' actor and locked-ioc-12, and details bounty claims against at least nine victim organizations.

Sources cited for PhantomRaven npm bug bounty stealer

• OSV Malware Advisory MAL-2026-1552 (typescript-nhost) osv.dev · Advisory · 2026-03-16
• The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks endorlabs.com · Research · 2026-02-25
• PhantomRaven: npm Malware Uses Remote Dynamic Dependencies sonatype.com · Vendor report · 2025-10-31
• PhantomRaven NPM Supply-Chain Attack: How Remote Dependencies Hide Malware nowsecure.com · Vendor report · 2026-03-13
• PhantomRaven Wave 5: NPM Attack on DeFi, Cloud & AI Developers mend.io · Vendor report · 2026-08-01
• GitHub Security Advisory GHSA-mm3f-jjww-x883 GitHub · Code repository · 2026-03-16
• PhantomRaven: LLM-Generated Information Stealer for Bug Bounty Hunting CrowdStrike · Blog · 2026-09-15
• PhantomRaven Supply Chain Attack: 126 Malicious npm Packages Stealing GitHub Tokens and CI/CD Secrets rescana.com · Blog · 2025-11-05
• PhantomRaven returns to npm with 88 bad packages csoonline.com · News · 2026-02-20
• New PhantomRaven NPM attack wave steals dev data via 88 packages BleepingComputer · News · 2026-02-20

More in supply chain

• Software Supply Chain Attacks Overview: CCleaner, Codecov, SolarWinds Orion, npm Shai-Hulud, Kaseya VSA, MOVEit Transfer
• BO Team (Black Owl) Supply Chain Attack Against a Software Developer's Infrastructure (CVE-2021-44228)
• Backdoored ARTEX Docker Hub images (tomicdd/artex and clones) expose 62 consoles to unauthenticated root shell; CERT-In CIAD-2026-0058 flags AI-assisted actor Crafty Falcon
• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware

Previous and next in supply chain

• Admin Menu Editor Pro WordPress Plugin Backdoored via Supply-Chain Compromise, 1,500 Sites Affected Previous report
• Brevo Supply-Chain Attack: Stolen Cloudflare API Key Deploys Malicious Edge Worker, Backdoors 100,000+ Websites via ClickFix and a Rogue WordPress Plugin Next report

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages