CrowdStrike says PhantomRaven, a financially motivated bug-bounty actor, used typosquatted npm packages and npm install scripts to deliver a JavaScript information stealer, with November 2025 incidents tied to the domain npm.jpartifacts[.]com for command and control. The packages looked mostly harmless, but their install-time behavior gave the malware a path onto developer and build machines.
npm can run package scripts automatically during installation, so the infection happens before code review ever sees the payload in context. In this case, the trust break is the dependency install step itself: a package that appears ordinary can still execute code and reach out for commands, which puts local secrets and credentials at risk even when the source tree looks clean.
For teams that pull third-party packages into CI/CD or onto developer laptops, the exposure sits in the workflow that resolves dependencies, not just in the code they later inspect. The reporting does not settle how many environments were hit, but it does show that a believable npm identity can be enough to turn routine package installation into a theft path.
PhantomRaven: LLM-generated Information Stealer for Bug Bounty Hunting
CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.