PhantomRaven: The npm Malware Likely Written by an LLM to Fuel Bug Bounty Fraud

On September 15, 2026, CrowdStrike Counter Adversary Operations published its analysis of PhantomRaven, a JavaScript infostealer distributed through more than 100 malicious npm packages. The financially motivated actor behind the operation has presented as a bug bounty hunter on platforms such as HackerOne, Bugcrowd, and Intigriti since November 2022, but instead of selling stolen data on criminal markets, uses it to identify vulnerabilities to claim for payment.

How PhantomRaven Bypasses the npm Supply Chain

The malicious packages, first reported by Koi Security and DCODX in October 2025, did not contain the full payload directly. Instead, they used the RDD (remote dynamic dependency) technique, fetching executable code from external servers at install time. This architecture allowed them to evade flagging by security tools that analyze dependencies statically.

The campaign targeted the most widely used continuous integration ecosystems. PhantomRaven extracts environment variables specific to GitHub Actions, GitLab CI, Jenkins, and CircleCI, along with usernames and emails from the Git and npm configuration of the compromised environment. The malware also exfiltrates the system fingerprint, public IP address, and runtime details, giving the operator a detailed map of accessible infrastructure.

The actor attempted to expand distribution to PyPI with code structurally similar to PhantomRaven, indicating an intent to cover more package management ecosystems.

The Signs of Artificial Intelligence in the Malicious Code

CrowdStrike's assessment of LLM use does not rest on a single anomaly but on a constellation of consistent patterns. The source files contain verbose, descriptive comments typical of language model output, fragments of non-fully-functional placeholder code, and characteristics identifiable through statistical token-analysis patterns. These elements support a "high confidence" assessment, not absolute forensic certainty: the dossier does not identify the specific LLM used.

"Most criminal actors [...] rent commodity tools or operate their own proprietary malware; however, this threat actor has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs" — CrowdStrike

The innovation lies in the convergence: proprietary malware, likely generated with commercially accessible tools, distributed via supply chain attack, with a monetization model that bypasses traditional criminal markets for responsible disclosure platforms.

The Hidden Identity Behind the "JPD" Usernames

CrowdStrike has linked at least two npm accounts to the operation, both now inaccessible. The seven associated online identities include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh. The "JPD" string recurs in the usernames and matches the contact email of the bug bounty hunter active on HackerOne, Bugcrowd, and Intigriti since 2022.

Both analyzed PhantomRaven packages contain the threat actor's name and initials in the description and author fields of the package.json file, a linking element CrowdStrike assesses with "high confidence." The actor has claimed bounties from at least nine entities in the technology, retail, and hospitality sectors, though the dossier does not specify whether these rewards stem from vulnerabilities created via PhantomRaven or from legitimate security research.

What to Do Now

For organizations using npm, verifying dependencies before installation is paramount. Packages with names resembling popular libraries but showing anomalous downloads warrant manual inspection. DevOps teams should scrutinize the author and description fields in the package.json of new or little-known dependencies, given the actor placed their own identifiers in those metadata fields.

Bug bounty platforms must validate that submissions stem from independent discovery rather than conditions created by the submitter. The PhantomRaven case demonstrates how an actor can compromise an asset, extract access data via malware, and then present the same compromise as a discovered vulnerability. HackerOne, Bugcrowd, and Intigriti should cross-reference submission timestamps with any suspicious package installations in target environments.

Static dependency analysis tools must integrate detection of RDD patterns: packages that fetch code from external URLs at install time, even when the libraries themselves contain no direct payload, represent a documented risk vector. The campaign of over 100 packages demonstrates this technique is scalable and actively exploited.

Why This Matters

The PhantomRaven operation introduces a perverse incentive into the software supply chain: malicious packages are not vehicles for traditional theft but tools to generate the very conditions the bug bounty hunter then claims to have "discovered." In August 2025, the actor explicitly claimed an RCE vulnerability via a malicious npm package published with a preinstall script execution: the vulnerability was induced, not discovered.

This model erodes trust in responsible disclosure programs. If compromise data fuels payouts instead of criminal markets, the line between legitimate research and orchestrated attack dissolves. The likely use of LLMs to lower the technical barrier for malware development amplifies the problem's scalability: operators with limited skills can produce proprietary tools with integrated evasion patterns.

The combination of 100+ distributed packages, seven linked identities, activity dating to 2022, and bounties from nine documented entities describes a structured, persistent operation, not an isolated attempt. The absence of exfiltrated data on stealer log shops confirms the business model differs from conventional infostealers: the value lies not in selling the data but in converting it into disclosure rewards.

Sources: The Hacker News | Cyber Daily