CrowdStrike's Counter Adversary Operations has profiled PhantomRaven, a JavaScript information stealer distributed through npm by an operator who works as a bug bounty hunter — and who, CrowdStrike assesses with high confidence, likely wrote the malware with a large language model, on the evidence of verbose comments, placeholder code and statistical token-analysis patterns. The operator is attributed to two npm accounts, jpdhellonpm1 and jpd15, publishing packages named transform-jsbi-to-bigint and sort-imports-es6-autofix; both packages carry files containing the threat actor's name and initials in their description and author fields, both usernames include the string "JPD" that appeared in the address used to contact a potential victim, and industry sources associate further usernames — jpd12, jpd13, npmhell, npmpackagejpd, jpdhackerone11 — with PhantomRaven deployments. In November 2025 the operator contacted a potential victim organisation claiming to have identified a compromised device and attributing it to a dependency-confusion attack using malicious npm packages to deploy PhantomRaven, an approach that reads as an extortion or credibility play built on their own intrusion tooling. The operator has been publicly active as a bug bounty hunter since November 2022 and, by their own account, has collected bounties from at least nine entities across technology, retail and hospitality through Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne. CrowdStrike has not observed PhantomRaven logs for sale on log shops, which supports its assessment that the stealer is used to find submission-worthy findings rather than to sell access — a materially different economic model from the crimeware market. CrowdStrike Falcon Complete responded to and remediated multiple incidents involving the stealer.

• Source article