PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

Immediate Actions

Key Takeaways

• Threat actor uses bug bounty platforms (HackerOne) as cover for malicious compromise activity
• npm version 12+ blocks preinstall scripts by default, mitigating this vector
• Malware contacts api64.ipify.org to resolve external IP before exfiltration
• Code assessed as LLM-generated with high confidence based on token analysis and verbose comments
• Threat actor also developed a Python/PyPI variant of the stealer

Attack Chain

1. Initial Access: Typosquatted npm packages use HTTP RDD links to fetch malicious dependencies at install time
2. Execution: Preinstall script auto-executes PhantomRaven JS payload within NodeJS runtime
3. Discovery: Malware collects OS, hostname, IP, process details, and CI/CD environment variables
4. Credential Access: Reads Git and npm configuration files for email addresses and credentials
5. C2: Exfiltrates collected data via HTTP GET and POST to attacker-controlled domains
6. Exfiltration: Data serialized as JSON in POST body; incomplete WebSocket fallback method exists

Affected Systems

• NodeJS runtime environments
• npm package manager users
• GitHub Actions CI/CD pipelines
• GitLab CI pipelines
• Jenkins CI/CD servers
• CircleCI pipeline environments

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• DNS resolution logs
• HTTP proxy logs
• npm install logs
• EDR process telemetry
• CI/CD pipeline logs

Key Behavioral Indicators

• NodeJS process reading .gitconfig or .npmrc followed by HTTP POST
• npm install fetching dependencies from non-registry HTTP URLs
• Minimal user-agent string missing browser type and version fields
• NodeJS process accessing CI/CD-specific environment variables outside pipeline context

Control Gaps

• Standard npm registry lacks controls against typosquatted packages
• Preinstall scripts execute automatically in npm versions prior to 12
• CI/CD environment variable access by arbitrary processes is often unmonitored
• Dependency URLs in package.json are not inspected by default

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Implement private npm registry with controlled, monitored package installations
• Block outbound HTTP requests from CI/CD build agents to non-registry domains
• Rotate CI/CD secrets and API tokens exposed in environment variables on affected systems

User Protection

• Deploy EDR rules alerting on NodeJS processes reading credential config files
• Enforce allowlisting for npm package sources in developer workstations and CI/CD runners
• Monitor and alert on typosquatted package installations across development environments

Security Awareness

• Train developers on dependency-confusion and typosquatting attack vectors
• Require code review of package.json dependency declarations before installation

MITRE ATT&CK Mapping

Plain-Language Summary

A criminal actor created a malware tool called PhantomRaven that steals sensitive information from developers' computers. The malware hides inside fake npm software packages that look similar to real ones. When installed, it automatically runs and collects system details, developer credentials, and CI/CD pipeline secrets, then sends everything to servers the attacker controls. The attacker appears to use bug bounty programs as a cover story for the theft. Organizations using npm should update to version 12 or later and disable automatic script execution.

Additional IOCs

• Command Lines:
  • Purpose: Preinstall script auto-execution during npm package installation | Tools: npm, node | Stage: Execution | node index.js