Press play to start listening
A self-described bug bounty hunter developed and distributed an information stealer through malicious npm packages and may have used compromised systems to find vulnerabilities that could later be submitted for bug bounty payments, according to new research from CrowdStrike.
The malware, called PhantomRaven, is a JavaScript-based information stealer targeting developers and software development environments. CrowdStrike said its Falcon Complete team responded to and remediated multiple incidents involving the malware and identified packages used to deliver it.
The company also assessed with high confidence that PhantomRaven’s code was generated using a large language model (LLM). Researchers based that assessment on statistical token patterns, unusually verbose comments, placeholder code and design choices they considered consistent with AI-generated programming.
Malicious npm Packages Hide the Real Payload
PhantomRaven is delivered through npm packages designed to resemble legitimate developer tools. CrowdStrike highlighted two packages, transform-jsbi-to-bigint and sort-imports-es6-autofix, associated with the npm accounts jpdhellonpm1 and jpd15.
The packages contain little obviously malicious code themselves. Instead, they specify a dependency using an HTTP URL. When a developer installs one of the packages, npm retrieves the dependency from infrastructure controlled by the operator, where the actual PhantomRaven payload is hosted.
The downloaded package contains a preinstall script that executes during installation. This use of remote dynamic dependencies was documented when Koi Security first exposed PhantomRaven in October 2025.
That investigation identified more than 126 malicious npm packages with over 86,000 downloads. Later research from Endor Labs found another 88 packages distributed in three subsequent waves between November 2025 and February 2026.
Once running, PhantomRaven collects the operating system, architecture, hostname, local and external IP addresses, Node.js version, usernames and email addresses found in Git and npm configurations.
It also collects CI/CD-related environment variables associated with GitHub Actions, GitLab CI, Jenkins and CircleCI, which CrowdStrike said could expose authentication tokens and API keys. The information is sent to operator-controlled infrastructure through HTTP GET and POST requests.
The same delivery method is harder to use with npm 12, released in July 2026. Dependency lifecycle scripts no longer run unless explicitly allowed, while dependencies hosted at remote URLs are also blocked by default. CrowdStrike recommends updating npm, restricting lifecycle scripts, reviewing dependency-confusion attempts and considering private registries.
CrowdStrike Links Malware to Bug Bounty Activity
CrowdStrike believes the stolen information may have been used to support the operator’s bug bounty activity.
The cybersecurity firm linked the activity to a self-described bug bounty hunter who has been active since November 2022. According to the researcher’s public profile, the individual claims to have received rewards from at least nine organizations in the technology, retail and hospitality sectors through platforms including HackerOne, Bugcrowd, Intigriti, YesWeHack and HackenProof.
In November 2025, the operator contacted a potential victim and claimed to have discovered a compromised device through a dependency-confusion attack involving malicious npm packages.
CrowdStrike also found that, in August 2025, the same individual claimed to have achieved remote code execution against another target using a malicious npm package, although the company said it could not independently verify that claim.
Researchers have not observed PhantomRaven logs being sold through criminal log markets. CrowdStrike therefore assesses that the operator likely developed the malware to compromise company assets and identify opportunities that could subsequently be submitted for bug bounty rewards.
Package Owner Denied Malicious Intent
There is another side to the attribution. When Endor Labs investigated later PhantomRaven waves earlier this year, the package owner contacted researchers and denied malicious intent. The individual said the extensive information collection was intended to demonstrate supply-chain weaknesses to affected organizations for responsible disclosure or possible bug bounty submissions.
Endor Labs said at the time that it had not seen evidence that actual secrets or credentials were exfiltrated in the packages it analyzed, although it still considered the collection techniques risky and inconsistent with common security research practices.
The case also raises questions about the boundaries of bug bounty research, particularly when packages used for testing collect information from systems without the owners’ permission.
