A financially motivated threat actor has been linked to the creation and distribution of a JavaScript-based information stealer called PhantomRaven through the npm package registry This article explores malware threat actor. . The developer likely used a large language model (LLM) to write the malware, as assessed with high confidence based on verbose comments, placeholder code, and statistical token analysis patterns, according to CrowdStrike's Counter Adversary Operations.
PhantomRaven was first flagged by Koi Security and DCODX in late October 2025, drawing attention to a phishing and typosquatting campaign that uploaded over 100 malicious packages to npm, with the goal of stealing authentication tokens, CI/CD secrets, and GitHub credentials from developers' machines.
This software supply chain attack utilized these packages as a cover to retrieve a remote dynamic dependency (RDD) from an external server, ensuring that the libraries themselves would not be flagged by security tools. The latest findings from CrowdStrike reveal that the threat actor has been active since November 2022 and claims to be a bug bounty hunter who has collected bounties from nine entities across the technology, retail, and hospitality sectors. "Most criminal actors" rent commodity tools or operate their own proprietary malware; however, this threat actor has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs."
