The PhantomRaven operator turned stolen CI/CD secrets into bug bounty payouts, CrowdStrike says
CrowdStrike says the npm stealer's author has been active since November 2022, claims bounties from at least nine companies, and that none of the stolen logs have turned up for sale. It assesses with high confidence that an LLM wrote the code.
The Watch · Security desk
What happened
- CrowdStrike Counter Adversary Operations attributes PhantomRaven, a JavaScript information stealer distributed through npm, to a financially motivated actor who works as a bug bounty hunter.
- Koi Security and DCODX first flagged the campaign in late October 2025, counting more than 100 typosquatted and slopsquatted npm packages built to take authentication tokens, CI/CD secrets and GitHub credentials.
- The operator has been active since November 2022 and, on their public X profile, claims bounties from at least nine companies in technology, retail and hospitality via five submission platforms.
- CrowdStrike says it has seen no PhantomRaven logs for sale on stealer log shops, which it says indicates the operator uses the theft only to find bounty submissions.
Why it matters
- Who's exposed exposure Every organisation that triaged one of this operator's reports had already run his install script inside a build environment holding live tokens.
- What it limits constraint Credential-market monitoring, the signal that usually tells a company its tokens leaked, has nothing to fire on here, so detection falls back to what the build agent does on the network.
- Who has to decide decision Disclosure programs have to settle whether a compromise the reporter created with their own preinstall script counts as a submission or as an intrusion.
- What it sets up precedent The PyPI attempt points to the same stealer being carried into another registry before any change in evasion technique.
Next story · Security · 3d ago
npm Trusted Publishing accepted a freed GitHub repo name as proof of who may publishConfirmed3 publishers
The property that keeps PhantomRaven out of package scans is in the install path. Each package declares a remote dynamic dependency fetched from an external server, so the library uploaded to npm is not the thing that carries the stealer and is not what gets flagged [9]. Koi Security and DCODX counted more than 100 such packages when they surfaced the campaign in late October 2025 [8].
The payload lands where the credentials are. It reads usernames and email addresses out of Git and npm configuration, takes runtime details and a system fingerprint including the public IP, and collects the CI/CD environment variables set by GitHub Actions, GitLab CI, Jenkins and CircleCI, then sends the results to a server the operator controls [11][10]. The October reporting described the targets as authentication tokens, CI/CD secrets and GitHub credentials [8]. CrowdStrike's Falcon Complete team says it remediated multiple incidents involving PhantomRaven, without giving a count [17].
Then the operator reported the compromise. In November 2025 the actor contacted a potential victim organisation to say it had a compromised device and attributed it to a dependency-confusion attack using malicious npm packages that deployed PhantomRaven; the sender's username contained the string JPD [16]. In August 2025 the same actor claimed a remote code execution finding through a package they had published themselves [14]. "The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE," security researcher Maddie Stewart wrote [15].
CrowdStrike described the model directly: this actor "has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs" [3]. According to the operator's public X profile, bounties have come from at least nine entities in technology, retail and hospitality, through Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne [4]. Activity dates to November 2022, 35 months before the packages were publicly identified [18].
The LLM assessment rests on style: verbose comments, placeholder code and statistical token-analysis patterns, held at high confidence [2]. CrowdStrike did not give a cost or authoring-time estimate for the 100-plus packages, and the October reporting did not either, so mass production is beyond what the evidence supports. The evidence supports the install-time execution path and the secrets within reach of it.
The two named npm accounts, jpdhellonpm1 and jpd15, are no longer accessible [12]. CrowdStrike ties both to one operator on the basis that the package files name the actor in their description and author fields and both usernames contain the JPD string from the contact email [7]. Seven further handles are linked to the operation, among them jpd12, npmhell and packagedharsh [13], and CrowdStrike says the actor also tried to push a similar stealer to PyPI [19].
What to watch
- Whether Bugcrowd, Intigriti, YesWeHack, HackenProof or HackerOne act on the submitter accounts CrowdStrike ties to the PhantomRaven operator.
- Whether the PyPI attempt turns into published packages carrying the same stealer code.
- PhantomRaven logs appearing for sale would break CrowdStrike's assessment that the operator uses the stealer only to find bounties.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence58
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CrowdStrike Counter Adversary Operations identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven via npm.
- [2]
"The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns," CrowdStrike's Counter Adversary Operations said.
- [3]
"Most criminal actors [...] rent commodity tools or operate their own proprietary malware; however, this threat actor has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs," CrowdStrike said.
- [4]
The PhantomRaven operator has been active since November 2022 and, according to their public X profile, has collected bounties from at least nine entities across the technology, retail and hospitality sectors using Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne.
- [5]
CrowdStrike Counter Adversary Operations has not observed PhantomRaven logs for sale on log shops, further indicating that the operator likely uses the information stealer solely to identify bug bounty opportunities.
- [6]
Falcon Complete identified two npm packages containing PhantomRaven scripts: transform-jsbi-to-bigint, published by npm user jpdhellonpm1, and sort-imports-es6-autofix, published by npm user jpd15.
- [7]
CrowdStrike assesses with high confidence that one actor operates both npm monikers, because both PhantomRaven packages contain files with the threat actor's name and initials in the description and author fields and both usernames include the string JPD from the initial contact email.
- [8]
PhantomRaven was first flagged by Koi Security and DCODX in late October 2025, in a slopsquatting and typosquatted campaign in which more than 100 malicious packages were uploaded to npm to steal authentication tokens, CI/CD secrets and GitHub credentials from developers' machines.
- [9]
The attack used the npm packages as cover to retrieve a remote dynamic dependency from an external server so that the libraries themselves are not flagged by security tools.
- [10]
Once installed, the malware embedded in the remote dependency scans the developer environment for email addresses, gathers information about the CI/CD environment, collects a system fingerprint including the public IP address, and transmits the results to an attacker-controlled server.
- [11]
PhantomRaven also collects runtime details, the current date and time, username and email addresses from Git and npm configurations, and CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins and CircleCI.
- [12]
Both npm accounts maintained by the operator, jpdhellonpm1 and jpd15, are no longer accessible as of writing.
- [13]
Other online identities linked to the same operation include jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11 and packagedharsh.
- [14]
In August 2025, the threat actor claimed to have discovered a remote code execution vulnerability via a malicious npm package they published.
- [15]
"The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE," security researcher Maddie Stewart noted.
- [16]
In November 2025, the threat actor deploying PhantomRaven contacted a potential victim organization and claimed to have identified a compromised device, attributing the compromise to a dependency-confusion attack that used malicious npm packages to deploy PhantomRaven; the email address used included the string JPD as part of the username.
- [17]
CrowdStrike Falcon Complete managed detection and response responded to and remediated multiple incidents involving PhantomRaven.
- [18]
The operator was active for about 35 months before the PhantomRaven packages were publicly flagged.
- [19]
Evidence has emerged that the threat actor attempted to push packages to the Python Package Index containing information stealer code exhibiting similarities with PhantomRaven.
Sources
2 independent publishers whose own reporting we read for this story.
Topics and entities
Topics
- LLM-assisted malware
- Software Supply Chain Security
- Bug Bounty Programs