CrowdStrike links PhantomRaven npm malware to alleged bug-bounty hunting

Multiple real-world PhantomRaven incidents remediated by CrowdStrike underpin a new assessment about who operated the npm campaign and why. In research published on 15 September 2026, the company described the unnamed operator as a self-proclaimed bug-bounty hunter and said the JavaScript information stealer was almost certainly generated using a large language model.

The findings add direct incident-response evidence and a disputed financial motive to a software supply-chain operation first exposed in 2025. CrowdStrike did not name affected organisations, disclose incident dates or provide a complete victim count.

CrowdStrike identified two delivery packages during its investigations. The package transform-jsbi-to-bigint was published through the npm account jpdhellonpm1, while sort-imports-es6-autofix came from the account jpd15. CrowdStrike linked the accounts with high confidence to the same unnamed operator.

Remote dependencies concealed the second stage

PhantomRaven abuses routine package installation rather than a disclosed software vulnerability. A benign-looking or typosquatted npm package declares a dependency through an HTTP URL. npm retrieves that second package from infrastructure controlled by the operator, where a preinstall lifecycle script can run the information stealer.

This design makes the remote dependency an important supply-chain blind spot. The package listed in the public registry can appear less suspicious because the active component sits elsewhere. Remotely served content can also be altered without publishing a new npm release, complicating reviews based only on the registry package.

Endor Labs documented that capability on 12 March 2026, when it reported that one remotely delivered data-harvesting payload had been replaced with a benign minimal script. The change did not require a fresh release of the package that referenced it.

The analysed stealer gathers operating-system and host details, Git and npm identity information, process and environment data, and variables associated with GitHub Actions, GitLab CI, Jenkins and CircleCI. It includes functionality to transmit collected information using HTTP GET and POST requests.

Execution on developer workstations or build runners could therefore expose information held in development and deployment environments. If environment variables contain authentication tokens, API keys or other secrets, that exposure could provide paths into source repositories, package-publishing accounts or deployment pipelines. No specific downstream compromise, successful credential theft, service outage or quantified financial loss has been publicly confirmed.

The incidents establish real-world deployment rather than activity confined to research samples. However, they do not show that the packages or associated command-and-control infrastructure remained active at the evidence cutoff on 16 September. No CVE was identified in the reviewed sources because PhantomRaven abuses malicious packages and package-manager functionality rather than a disclosed flaw.

AI assessment rests on code forensics

CrowdStrike’s conclusion about AI involvement is a forensic assessment, not confirmation from an identified model provider. Its researchers cited statistical patterns in code tokens, unusually extensive comments, placeholder sections and unconventional design decisions as evidence that an LLM probably generated the malware.

The company did not identify a particular model, service or AI developer, leaving its high-confidence assessment short of conclusive proof.

The bug-bounty connection requires similar care. CrowdStrike assesses that the operator used information obtained through PhantomRaven compromises to identify vulnerabilities and seek rewards from established disclosure programmes. It also reported that a public social-media profile associated with the operator claimed bounty payments from at least nine organisations in the technology, retail and hospitality sectors.

Those public claims remain unverified. No independent payout record ties a specific reward to a finding obtained through PhantomRaven, the total amount allegedly earned is unknown, and there is no evidence that all nine organisations were targeted using the malware. The available reporting also does not establish that any bug-bounty platform knowingly paid for information derived from unauthorised access.

CrowdStrike said it had not observed PhantomRaven logs offered on criminal log shops and inferred that the operator probably reserved the collected information for bug-bounty opportunities. The absence of observed sales does not independently establish that motive or show what happened to data from individual incidents.

A campaign with a contested purpose

Koi Security traced PhantomRaven’s start to August 2025 and issued the first public disclosure on 29 October that year. It reported 126 packages and more than 86,000 downloads in the initial campaign. Endor Labs subsequently identified 88 packages across three later waves in research published on 10 March 2026. Those figures cover different periods and datasets, so they cannot be combined into a verified total without deduplication.

The campaign’s purpose has been disputed since before CrowdStrike’s attribution. Endor Labs said the package author contacted it on 17 March, denied malicious intent and claimed the packages collected information to demonstrate supply-chain weaknesses for responsible disclosure or potential bounty reports. Endor softened its description after the contact but maintained its security concerns.

Endor also reported that no secrets or credentials appeared to have been exfiltrated in the material it examined that March. CrowdStrike later found transmission capabilities in the code and handled multiple incidents, but did not publish victim-level evidence showing that usable credentials or secrets reached the operator. The author’s stated research purpose therefore remains unverified, as does CrowdStrike’s proposed link between particular compromises and bounty rewards.

npm 12 restricts the automatic delivery route

npm introduced protections relevant to PhantomRaven in npm 12.0.0, released as a stable version on 8 July 2026. Its default opt-in controls for dependency install scripts and remote URL dependencies disrupt the campaign’s automatic fetch-and-execute route under the default configuration.

The update is a preventive partial fix, not a declaration that npm 12 is categorically unaffected. A user can explicitly approve the restricted behaviour, and the new defaults cannot clean systems already exposed or remediate credentials that may have been available during earlier execution. No clean replacement versions are documented for CrowdStrike’s two named packages because they are malicious delivery artefacts, not vulnerable packages awaiting repaired releases.

CrowdStrike recommends moving to the latest npm release and restricting unapproved preinstall and postinstall scripts. Organisations can also route installations through private registries, deny unexpected remote-dependency requests, allow lifecycle scripts only for trusted packages and investigate CrowdStrike’s published indicators across developer endpoints and CI/CD environments.

Developer training should cover dependency confusion, typosquatting and plausible but nonexistent package names suggested by AI coding tools. npm audit can support package review, but it should remain one component of broader supply-chain monitoring.

For Australian software teams, the relevance is indirect but practical: npm, Node.js and cloud build services create the same exposure regardless of location. No Australian victim or regulatory action appears in the reviewed evidence, but local organisations using those development systems may need to investigate developer and CI/CD systems and review credentials available in those environments.

As at the 16 September evidence cutoff, the current registry status of the named packages, the wider package set and the campaign infrastructure had not been established. npm 12’s safer defaults reduce the delivery opportunity, but previously exposed developer and CI/CD systems still require investigation rather than reliance on the package-manager update alone.

Tracing how remote dependencies and lifecycle scripts operate within developer and build environments offers a concrete way to examine software supply-chain trust. Use The Hack Academy’s online cybersecurity training programme to deepen the relevant foundations at your own pace, pairing practical exercises with theory in networking, internet vulnerabilities and cybersecurity fundamentals.

Photo Credit: DepositPhotos.com