# PhantomRaven: LLM-Generated npm Information Stealer Used for Bug Bounty Hunting

> CrowdStrike attributed PhantomRaven, a JavaScript information stealer distributed via typosquatted/impersonated npm packages using Remote Dynamic Dependencies (RDD) to hide payloads off-registry, to a self-described bug bounty hunter operating under the 'JPD' handle since November 2022. Across at least four campaign waves (August 2025-February 2026, 200+ packages, 86,000+ downloads), the malware harvested Git/npm credentials and CI/CD secrets from GitHub Actions, GitLab CI, Jenkins, and CircleCI to fund bounty submissions to at least nine organizations.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2531
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-phantomraven-npm-bug-bounty-stealer-tl-2026-2531.webp?v=a12efcf0 (Threadlinqs threat intel: PhantomRaven LLM npm Stealer: Analysis & Hunting (TL-2026-2531) — High severity, 25 IOCs, 9 detection rules.)
- **ID:** TL-2026-2531
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** JPD
- **Detections:** 9 (1 shown free below) · **IOCs:** 25 (3 shown free below)

## Description

PhantomRaven is a JavaScript-based information stealer distributed through the npm registry via typosquatted and slopsquatted package names (e.g., transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, and impersonations of Adobe, Airbnb, GitLab, and Apache tooling). The wrapper packages advertise zero dependencies but embed a package.json dependency field pointing to an HTTP(S) URL on attacker-controlled infrastructure rather than a standard registry reference -- a technique researchers term Remote Dynamic Dependencies (RDD). When a developer or CI/CD pipeline runs `npm install`, npm silently fetches the remote tarball, which ships a `preinstall` lifecycle script that executes automatically (npm < 12) without a visible dependency entry in the npm web UI, defeating static registry scanning.

The executed payload (a ~259-line index.js, near-identical across waves) fingerprints the host (OS, hostname, architecture, Node.js version, public IP), harvests developer identity from `.gitconfig`, `.npmrc`, `package.json`, and environment variables, and specifically targets CI/CD indicators and secrets from GitHub Actions (`GITHUB_ACTIONS`), GitLab CI (`GITLAB_CI`), Jenkins (`JENKINS_URL`), and CircleCI, along with `npm_config_registry` and authentication tokens. Exfiltration is triple-redundant: HTTP GET, HTTP POST, and an incomplete WebSocket fallback (hardcoded to a placeholder `wss://yourserver.com/socket`) to attacker C2 domains.

CrowdStrike, building on Koi Security's initial October 29, 2025 disclosure (126+ packages) and Sonatype's follow-on identification of 83 more packages on October 31, 2025, tracked at least four infrastructure waves through February 2026, each rotating a newly registered C2 domain (all registered via Amazon Registrar with AWS Route53 nameservers and WHOIS privacy) while reusing the same payload logic and 'JPD' author-field artifact. CrowdStrike attributes the campaign to a financially motivated individual active as a bug bounty hunter since November 2022, correlating the 'JPD' username pattern across 50+ rotated npm publisher accounts, a GitHub account identified in December 2025, and the email jpdtester01@gmail.com (also used in a rejected February 2025 PyPI submission attempt), claiming payouts from at least nine victim organizations across technology, retail, and hospitality via Bugcrowd, Intigriti, YesWeHack, HackenProof, and HackerOne. Code-quality indicators -- verbose redundant comments, placeholder logic, and statistical token patterns -- led CrowdStrike to assess the malware as almost certainly LLM-generated. npm registry version 12 (released June 2026) mitigates the preinstall vector by requiring explicit developer approval before any preinstall script executes.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1585 Establish Accounts
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1057 Process Discovery
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PhantomRaven Remote Dynamic Dependency (RDD) npm Install / Preinstall Script Execution** (`TL-2026-2531-SPL-001`)

Detects the PhantomRaven initial-access mechanism: a package.json dependency field pointing to an attacker-controlled HTTP(S) URL instead of a standard registry reference (Remote Dynamic Dependency), fetched during `npm install` and executed via an automatic preinstall lifecycle script on npm CLI < 12. Fires on known PhantomRaven C2 tarball URLs, on the confirmed malicious/typosquatted package names (transform-jsbi-to-bigint, sort-imports-es6-autofix, typescript-nhost, adobe-alloy, airbnb-babel), and on the generic RDD indicator (an http(s) URL embedded in a dependency field) inside CI/CD build logs.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.001, T1195.002, T1608.001, T1036.005, T1059.007
- **Data sources:** ci_cd_build_logs (github_actions/gitlab_ci/jenkins/circleci), npm_registry_audit_log, sysmon (process_creation, EventID 1), edr_process_telemetry (DeviceProcessEvents)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=cicd_logs sourcetype IN ("github:actions:workflow_job","gitlab:ci:job","jenkins:build:console","circleci:job")
| rex field=_raw "(?<npm_dep_url>https?:\/\/[a-zA-Z0-9\.\-]+\/[^\s\"']+\.tgz)"
| eval known_c2_domain=if(match(npm_dep_url, "(?i)(npm\.jpartifacts\.com|packages\.storeartifact\.com|package\.storeartifacts\.com|npm\.artifactsnpm\.com|registry\.storageartifact\.com|packages\.storageartifact\.com)"), 1, 0)
| eval known_bad_package=if(match(_raw, "(?i)(transform-jsbi-to-bigint|sort-imports-es6-autofix|typescript-nhost|adobe-alloy|airbnb-babel)"), 1, 0)
| where isnotnull(npm_dep_url) OR known_bad_package=1
| eval detection_reason=case(known_c2_domain=1, "known_phantomraven_c2_rdd_tarball_url", known_bad_package=1, "known_malicious_package_name_match", isnotnull(npm_dep_url), "generic_rdd_indicator_http_url_as_dependency")
| table _time, host, source, sourcetype, npm_dep_url, detection_reason, _raw
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node.exe", "node")
| where InitiatingProcessFileName in~ ("npm.cmd", "npm", "npm-cli.js", "cmd.exe", "sh")
| where ProcessCommandLine has_any ("preinstall", "node_modules")
| extend SuspectPackage = extract(@"node_modules[\\/]([^\\/\s]+)", 1, ProcessCommandLine)
| where SuspectPackage in~ ("transform-jsbi-to-bigint","sort-imports-es6-autofix","typescript-nhost","adobe-alloy","airbnb-babel")
   or ProcessCommandLine has_any ("jpartifacts.com","storeartifact.com","storeartifacts.com","artifactsnpm.com","storageartifact.com")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SuspectPackage
| order by Timestamp desc
```

### Sigma

```yaml
title: PhantomRaven npm Remote Dynamic Dependency Preinstall Execution
id: e1f7ea48-8a2f-4a1b-9d3e-7c5b6a9f2d10
status: experimental
description: Detects a node.exe process spawned by npm during a preinstall lifecycle step for a package known to use the PhantomRaven Remote Dynamic Dependency technique, or referencing a known PhantomRaven C2/staging domain.
references:
  - https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/
  - https://github.com/advisories/GHSA-mm3f-jjww-x883
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-16
tags:
  - attack.resource-development
  - attack.t1608.001
  - attack.initial-access
  - attack.t1195.001
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.defense-evasion
  - attack.t1036.005
  - attack.tool.phantomraven
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\npm.cmd'
      - '\npm-cli.js'
      - '\cmd.exe'
  selection_child:
    Image|endswith:
      - '\node.exe'
  selection_context:
    CommandLine|contains:
      - 'preinstall'
      - 'node_modules'
  selection_known_package:
    CommandLine|contains:
      - 'transform-jsbi-to-bigint'
      - 'sort-imports-es6-autofix'
      - 'typescript-nhost'
      - 'adobe-alloy'
      - 'airbnb-babel'
  selection_known_infra:
    CommandLine|contains:
      - 'jpartifacts.com'
      - 'storeartifact.com'
      - 'storeartifacts.com'
      - 'artifactsnpm.com'
      - 'storageartifact.com'
  condition: (selection_parent and selection_child and selection_context) or selection_known_package or selection_known_infra
falsepositives:
  - Legitimate internal packages intentionally pinning a git+https tarball dependency for valid engineering reasons
  - SCA/security tooling scanning package.json files that happens to match the same command-line substrings
level: high
```

**Known false positives:**

- Legitimate internal packages intentionally using git+https or tarball URL dependencies for valid engineering reasons (e.g., pinned GitHub release tarballs)
- Security/SCA tooling itself scanning package.json files and matching on similar command-line substrings
- Engineers deliberately re-running the flagged package names in an isolated sandbox as part of incident remediation or malware analysis

**Tuning notes:** Extend the malicious-package-name list as new PhantomRaven waves rotate names (Wave 5, August 2026, targeted DeFi/cloud/AI dependency names) by pulling current indicators from GHSA-mm3f-jjww-x883 and OSV MAL-2026-1552; tighten the RDD regex to require the string appear within a package.json `dependencies`/`optionalDependencies` block context rather than any bare URL in a log line, to reduce noise from legitimate git+https dependency entries.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PhantomRaven Remote Dynamic Dependency (RDD) npm Install / Preinstall Script Execution (locked: unlock with TL Creds)
- PhantomRaven Git/npm Credential and CI/CD Secret Harvesting (locked: unlock with TL Creds)
- PhantomRaven C2 Exfiltration to Known Wave 1-4 Infrastructure (locked: unlock with TL Creds)
- PhantomRaven Remote Dynamic Dependency (RDD) npm Install / Preinstall Script Execution (locked: unlock with TL Creds)
- PhantomRaven Git/npm Credential and CI/CD Secret Harvesting (locked: unlock with TL Creds)
- PhantomRaven C2 Exfiltration to Known Wave 1-4 Infrastructure (locked: unlock with TL Creds)
- PhantomRaven Git/npm Credential and CI/CD Secret Harvesting (locked: unlock with TL Creds)
- PhantomRaven C2 Exfiltration to Known Wave 1-4 Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 25)

Defanged, TLP:CLEAR.

- IP address: `54.173.15[.]59`
- Domain: `npm[.]jpartifacts[.]com`
- File hash: `c31831d47fcbf52ff1f4e61838611916a4276d005a564e69946d5dac04235eed`

Full set of 25 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [PhantomRaven: LLM-Generated Information Stealer for Bug Bounty Hunting](https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/)
- [PhantomRaven returns to npm with 88 bad packages](https://www.csoonline.com/article/4144231/phantomraven-returns-to-npm-with-88-bad-packages.html)
- [The Return of PhantomRaven: Detecting Three New Waves of npm Supply Chain Attacks](https://www.endorlabs.com/learn/return-of-phantomraven)
- [PhantomRaven Supply Chain Attack: 126 Malicious npm Packages Stealing GitHub Tokens and CI/CD Secrets](https://www.rescana.com/post/phantomraven-supply-chain-attack-126-malicious-npm-packages-stealing-github-tokens-and-ci-cd-secret)
- [OSV Malware Advisory MAL-2026-1552 (typescript-nhost)](https://osv.dev/vulnerability/MAL-2026-1552)
- [PhantomRaven: npm Malware Uses Remote Dynamic Dependencies](https://www.sonatype.com/blog/phantomraven-npm-malware)
- [New PhantomRaven NPM attack wave steals dev data via 88 packages](https://www.bleepingcomputer.com/news/security/new-phantomraven-npm-attack-wave-steals-dev-data-via-88-packages/)
- [PhantomRaven NPM Supply-Chain Attack: How Remote Dependencies Hide Malware](https://www.nowsecure.com/blog/2026/03/13/phantomraven-npm-supply-chain-attack-how-remote-dependencies-hide-malware/)
- [PhantomRaven Wave 5: NPM Attack on DeFi, Cloud & AI Developers](https://www.mend.io/blog/phantomraven-wave-5-new-undocumented-npm-supply-chain-campaign-targets-defi-cloud-and-ai-developers/)
- [GitHub Security Advisory GHSA-mm3f-jjww-x883](https://github.com/advisories/GHSA-mm3f-jjww-x883)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2531