A threat actor tracked by CrowdStrike has been distributing a JavaScript information stealer called PhantomRaven through the npm package registry since at least November 2022, targeting software developers to harvest CI/CD pipeline secrets, GitHub credentials, and authentication tokens. What makes this case unusual is that the criminal appears to have used a large language model to write the malware — CrowdStrike assessed this “with high confidence” based on telltale patterns including verbose AI-style comments, placeholder code, and statistical token-analysis signatures left in the source.
The attacker uploaded more than 100 malicious packages to npm using typosquatting and slopsquatting techniques — naming packages to look like common legitimate libraries. The packages themselves don’t contain the full malicious payload; instead, they fetch a “remote dynamic dependency” from an external server at install time, keeping the malware off standard scanning tools. Once installed, PhantomRaven collects email addresses, system fingerprints, public IP addresses, and environment variables from GitHub Actions, GitLab CI, Jenkins, and CircleCI. CrowdStrike’s analysis revealed the actor doesn’t sell stolen data on dark web markets — instead, they appear to use compromised developer accounts to discover security vulnerabilities and then claim bug bounties from the affected companies.
How to check if you’re affected
Affected developers are those who installed npm packages from the accounts jpdhellonpm1 or jpd15 (both now removed), or specifically the packages transform-jsbi-to-bigint or sort-imports-es6-autofix. If these packages appear in your project’s dependency tree (check with npm ls), revoke all CI/CD tokens, GitHub personal access tokens, and API keys that were present in the build environment, and rotate any credentials that may have been exposed. Affected products include any developer environment or CI/CD pipeline where these packages were installed.
Sources
- Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer — The Hacker News / CrowdStrike Counter Adversary Operations