Malware & Tooling · Credential Theft

PhantomRaven Hides Stealer in npm Installs

CrowdStrike says PhantomRaven, a financially motivated bug-bounty actor, used typosquatted npm packages and npm install scripts to deliver a JavaScript information stealer, with November 2025 incidents tied to the domain npm.jpartifacts[.]com for command and control. The packages looked mostly harmless, but their install-time behavior gave the malware a path onto developer and build machines.

npm can run package scripts automatically during installation, so the infection happens before code review ever sees the payload in context. In this case, the trust break is the dependency install step itself: a package that appears ordinary can still execute code and reach out for commands, which puts local secrets and credentials at risk even when the source tree looks clean.

For teams that pull third-party packages into CI/CD or onto developer laptops, the exposure sits in the workflow that resolves dependencies, not just in the code they later inspect. The reporting does not settle how many environments were hit, but it does show that a believable npm identity can be enough to turn routine package installation into a theft path.

2 sources · Sep 18

Timeline

Sources

Part of the PlainSec briefing for 2026-09-19

Every edition of this story: PhantomRaven Hides Stealer in npm Installs

More from today