Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer

Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer Ravie LakshmananSep 18, 2026Malware / Cybercrime A financially motivated threat actor has been linked to the development and distribution of a JavaScript (JS)-based information stealer known as PhantomRaven via the npm package registry. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns," CrowdStrike's Counter Adversary Operations said in an analysis published this week. PhantomRaven was first flagged by Koi Security and DCODX in late October 2025, calling attention to a slopsquatting and typosquatted campaign in which more than 100 malicious packages were uploaded to npm to steal authentication tokens,…