Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

A threat actor posing as a bug bounty hunter has been linked to the development and distribution of PhantomRaven, a JavaScript-based information stealer targeting developers via malicious npm packages. The malware, likely generated using a large language model, retrieves remote dependencies to evade detection and steals authentication tokens, CI/CD secrets, and system information. The actor has used compromised environments to claim bug bounties from multiple organizations and has also attempted to distribute similar malware through PyPI.

AI-extracted · verify before operational use