CROWDSTRIKE has identified PhantomRaven, a JavaScript information stealer distributed through typosquatted npm packages and aimed at software developers and CI/CD environments. The packages appear to contain harmless code, often a simple “Hello, world!” script, but specify a remote dependency over HTTP. During installation, npm retrieves the dependency from attacker-controlled infrastructure, delivering the malware.
The fetched package includes a preinstall script that runs automatically and collects operating-system details, local and external IP addresses, user information and environment variables from GitHub Actions, GitLab CI, Jenkins and CircleCI.
The stolen data is sent to attacker-controlled infrastructure using HTTP GET and POST requests: encoded information is placed in the GET query string, while POST requests use JSON. An unfinished WebSocket exfiltration function also appears in the code. CrowdStrike said the malware was likely written with substantial use of a large language model, based on verbose comments, placeholder code and statistical token-analysis patterns.
Researchers suspect the operator is a self-described bug bounty hunter known as JPD or jpdhellonpm1, who allegedly used access to claim rewards from at least nine organisations in the technology, retail and hospitality sectors. There was no evidence in the article of the data appearing on underground markets.
Organisations are advised to monitor for unauthorised remote dependencies and consider private registries for package inspection. The article says npm version 12, released in June 2026, blocks preinstall scripts by default, requiring developers to approve them explicitly; warnings should not be bypassed without manually reviewing the code.