Security2 publishers3 min readPublished
The PhantomRaven operator turned stolen CI/CD secrets into bug bounty payouts, CrowdStrike says
CrowdStrike says the npm stealer's author has been active since November 2022, claims bounties from at least nine companies, and that none of the stolen logs have turned up for sale. It assesses with high confidence that an LLM wrote the code.
The Watch · Security desk
What happened
- CrowdStrike Counter Adversary Operations attributes PhantomRaven, a JavaScript information stealer distributed through npm, to a financially motivated actor who works as a bug bounty hunter.
- Koi Security and DCODX first flagged the campaign in late October 2025, counting more than 100 typosquatted and slopsquatted npm packages built to take authentication tokens, CI/CD secrets and GitHub credentials.
- The operator has been active since November 2022 and, on their public X profile, claims bounties from at least nine companies in technology, retail and hospitality via five submission platforms.
- CrowdStrike says it has seen no PhantomRaven logs for sale on stealer log shops, which it says indicates the operator uses the theft only to find bounty submissions.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Every organisation that triaged one of this operator's reports had already run his install script inside a build environment holding live tokens.
- constraint Credential-market monitoring, the signal that usually tells a company its tokens leaked, has nothing to fire on here, so detection falls back to what the build agent does on the network.
- decision Disclosure programs have to settle whether a compromise the reporter created with their own preinstall script counts as a submission or as an intrusion.
- precedent The PyPI attempt points to the same stealer being carried into another registry before any change in evasion technique.
The property that keeps PhantomRaven out of package scans is in the install path. Each package declares a remote dynamic dependency fetched from an external server, so the library uploaded to npm is not the thing that carries the stealer and is not what gets flagged [4]. Koi Security and DCODX counted more than 100 such packages when they surfaced the campaign in late October 2025 [3].
The payload lands where the credentials are. It reads usernames and email addresses out of Git and npm configuration, takes runtime details and a system fingerprint including the public IP, and collects the CI/CD environment variables set by GitHub Actions, GitLab CI, Jenkins and CircleCI, then sends the results to a server the operator controls [6][5]. The October reporting described the targets as authentication tokens, CI/CD secrets and GitHub credentials [3]. CrowdStrike's Falcon Complete team says it remediated multiple incidents involving PhantomRaven, without giving a count [17].
Then the operator reported the compromise. In November 2025 the actor contacted a potential victim organisation to say it had a compromised device and attributed it to a dependency-confusion attack using malicious npm packages that deployed PhantomRaven; the sender's username contained the string JPD [14]. In August 2025 the same actor claimed a remote code execution finding through a package they had published themselves [12]. "The threat actor explained that they had compromised the target machine and executed their preinstall script, which purportedly allowed them to achieve RCE," security researcher Maddie Stewart wrote [13].
CrowdStrike described the model directly: this actor "has likely developed their proprietary PhantomRaven to compromise company assets and then used these compromises as leverage to claim rewards from reputable disclosure programs" [16]. According to the operator's public X profile, bounties have come from at least nine entities in technology, retail and hospitality, through Bugcrowd, Intigriti, YesWeHack, HackenProof and HackerOne [7]. Activity dates to November 2022, 35 months before the packages were publicly identified [18].
The LLM assessment rests on style: verbose comments, placeholder code and statistical token-analysis patterns, held at high confidence [2]. CrowdStrike did not give a cost or authoring-time estimate for the 100-plus packages, and the October reporting did not either, so mass production is beyond what the evidence supports. The evidence supports the install-time execution path and the secrets within reach of it.
The two named npm accounts, jpdhellonpm1 and jpd15, are no longer accessible [10]. CrowdStrike ties both to one operator on the basis that the package files name the actor in their description and author fields and both usernames contain the JPD string from the contact email [19]. Seven further handles are linked to the operation, among them jpd12, npmhell and packagedharsh [11], and CrowdStrike says the actor also tried to push a similar stealer to PyPI [15].
What to watch
- Whether Bugcrowd, Intigriti, YesWeHack, HackenProof or HackerOne act on the submitter accounts CrowdStrike ties to the PhantomRaven operator.
- Whether the PyPI attempt turns into published packages carrying the same stealer code.
- PhantomRaven logs appearing for sale would break CrowdStrike's assessment that the operator uses the stealer only to find bounties.