Affected Systems

npm package registry users and developers; over 100 malicious packages uploaded between November 2022 and October 2025. Threat actor also attempted PyPI repository compromise. Targets include CI/CD environments (GitHub Actions, GitLab CI, Jenkins, CircleCI) and developer workstations.

Exploitation Status

Active campaign confirmed. Over 100 malicious npm packages distributed between November 2022 and October 2025 using typosquatting and slopsquatting techniques. Malicious npm accounts (jpdhellonpm1, jpd15) have been taken down as of September 2026. No evidence of stolen data appearing on stealer log marketplaces; threat actor appears to use compromised credentials for bug bounty fraud.

Business Impact

PhantomRaven targets developer environments to exfiltrate authentication tokens, CI/CD secrets, GitHub credentials, Git/npm configuration data, system fingerprints, and public IP addresses. Compromised credentials enable unauthorized access to source code repositories, build pipelines, and production infrastructure. Threat actor claims to leverage stolen access for fraudulent bug bounty submissions rather than direct sale of credentials. Organizations using npm dependencies face supply chain risk from remote dynamic dependencies (RDD) that evade static analysis.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Audit npm dependencies for packages matching known malicious names: transform-jsbi-to-bigint, sort-imports-es6-autofix, and other packages from accounts jpdhellonpm1 and jpd15
  • Implement npm package integrity checks and block remote dynamic dependencies (RDD) that fetch code from external servers at install time
  • Rotate all authentication tokens, GitHub credentials, CI/CD secrets, and npm tokens for developers who installed npm packages between November 2022 and October 2025
  • Monitor CI/CD logs (GitHub Actions, GitLab CI, Jenkins, CircleCI) for unauthorized access attempts or unexpected environment variable enumeration
  • Deploy endpoint detection rules to identify outbound connections from developer workstations to unknown command-and-control infrastructure during package installation

---

# Threat Actor Context

Actor Profile

A financially motivated threat actor, active since November 2022, who claims to be a bug bounty hunter. The actor has allegedly collected bounties from at least nine entities across technology, retail, and hospitality sectors. They developed and distributed PhantomRaven, a JavaScript-based information stealer, through the npm package registry. The actor operates multiple online identities including jpd12, jpd13, jpdhellonpm1, jpd15, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11, and packagedharsh. CrowdStrike assesses the actor likely uses stolen information solely to identify bug bounty opportunities rather than selling data on stealer log shops, representing an unusual monetization strategy that leverages compromised assets as leverage for claiming rewards from legitimate disclosure programs.

TTPs (Tactics, Techniques, Procedures)

The actor employed software supply chain attacks via slopsquatting and typosquatting campaigns, uploading over 100 malicious npm packages. Key techniques include: remote dynamic dependency (RDD) retrieval from external servers to evade security tool detection; credential harvesting targeting authentication tokens, CI/CD secrets, and GitHub credentials; system fingerprinting including public IP address collection; environment reconnaissance gathering email addresses, Git/npm configurations, and CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins, and CircleCI. The actor also attempted similar operations on Python Package Index (PyPI). In August 2025, the actor claimed to have achieved remote code execution (RCE) via malicious npm package preinstall scripts. High-confidence assessment indicates the malware was developed using a large language model based on verbose comments, placeholder code, and statistical token-analysis patterns.

Targets & Patterns

Primary targets are software developers and organizations in the Software Development and Technology sectors. The targeting pattern focuses on developer environments to harvest credentials and CI/CD pipeline secrets. The actor specifically targets authentication mechanisms and continuous integration/continuous deployment infrastructure across multiple platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI). The motivation appears to be identifying security vulnerabilities in target organizations' assets, then leveraging these compromises to claim bug bounty rewards from legitimate disclosure programs. This represents an unusual targeting strategy where the goal is not direct financial gain through data sale, but rather using compromised access as proof-of-concept for vulnerability disclosure rewards. The actor has claimed bounties from at least nine entities across technology, retail, and hospitality sectors, suggesting broad opportunistic targeting rather than focused vertical specialization.

Historical Context

PhantomRaven was first identified by Koi Security and DCODX in late October 2025. CrowdStrike's analysis reveals the threat actor has been active since November 2022, indicating approximately three years of operations before initial public disclosure. The campaign involved over 100 malicious packages uploaded to npm. At least two npm user accounts (jpdhellonpm1 and jpd15) were used to distribute packages containing PhantomRaven; both accounts are no longer accessible as of the report date. In August 2025, the actor publicly claimed to have discovered an RCE vulnerability via a malicious npm package they published. The actor has also attempted to expand operations to the Python Package Index (PyPI) with similar information stealer code exhibiting PhantomRaven characteristics. This campaign represents an evolution in threat actor monetization strategies, moving from traditional data theft and sale to leveraging compromised access for legitimate bug bounty program exploitation.

Defensive Recommendations

  • Implement npm package verification controls including dependency pinning, lock file integrity checks, and automated scanning for typosquatted package names before installation
  • Monitor and restrict remote dynamic dependency (RDD) retrieval by enforcing policies that block external dependency resolution from untrusted sources during package installation
  • Deploy behavioral detection for preinstall and postinstall script execution that accesses sensitive files (e.g., .git/config, .npmrc, CI/CD environment variables) or performs network exfiltration
  • Audit CI/CD pipeline configurations to minimize exposed environment variables and implement secret management solutions that rotate credentials and limit scope to specific pipeline stages
  • Establish baseline monitoring for developer workstation network activity to detect anomalous connections to external C2 infrastructure, particularly from package manager processes