Do Son 
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | PhantomRaven |
| Threat Actor | Suspected bug bounty hunter (Aliases: JPD, jpdhellonpm1) |
| Target Victims | Software developers and CI/CD pipelines |
| Delivery Vector | Typosquatted npm packages via HTTP dependencies |
| Key Capabilities | Harvests CI/CD environment variables and system data |
| Source | CrowdStrike Counter Adversary Operations |
Executive
CrowdStrike has identified a supply-chain threat named the PhantomRaven information stealer. A self-proclaimed bug bounty hunter deployed this JavaScript malware through the npm registry to steal corporate secrets. The threat actor then used these compromised systems to claim financial rewards from disclosure programs.
Delivery and Typosquatting Tactics
Security researchers found that the threat actor distributes the LLM-generated PhantomRaven information stealer via typosquatted npm packages. These packages contain minimal, non-malicious code. Typically, they hold a simple “Hello, world!” script.
However, the packages also specify a remote dependency using an HTTP URL. This method bypasses standard npm package references. CrowdStrike stated, “At installation, npm fetches this remote dependency from attacker-controlled infrastructure; the returned package is the PhantomRaven payload.”
Infection Chain Architecture
The fetched malicious package contains a preinstall script. This script automatically executes during the installation process. The malware then gathers operating system details, local and external IP addresses, and user information.
Furthermore, the tool explicitly targets continuous integration and deployment environments. It collects environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI. The operator uses these stolen variables to prove a security impact to victim organizations.
According to public social media profiles, the threat actor collected bounties from at least nine entities across the technology, retail, and hospitality sectors. Analysts suspect a user known as JPD operates this campaign.
Command-and-Control and Data Exfiltration
After gathering the host data, the malware contacts a public API service to determine its external IP address. The PhantomRaven information stealer then transmits the stolen variables to attacker-controlled infrastructure. It sends data using both HTTP GET and POST requests.
The GET request places encoded data directly into the query string. Meanwhile, the POST method formats the stolen data as JSON. The source code also contains an incomplete WebSocket exfiltration function holding placeholder URLs.
CrowdStrike noted, “The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns.” Because logs never appeared on underground markets, experts believe the actor solely used the data to extort bounty payouts.
Defense and Detection Guidance
Organizations must monitor their development environments for unauthorized remote dependencies. Security teams should use private registries to inspect packages before they reach developer workstations.
In June 2026, the npm registry released version 12 to address this exact threat. This update blocks preinstall scripts by default. Developers must explicitly approve a script before it can run.
Security administrators should ensure developers do not bypass these warnings without manual code inspections.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
