PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting

This report analyzes PhantomRaven, an apparently LLM-generated JavaScript information stealer distributed through typosquatted npm packages that fetch remote dependencies and execute preinstall scripts; it describes the malware’s data collection (system info and CI/CD credentials), C2 infrastructure and IOCs (domains, IP, SHA256 hashes), MITRE technique mappings, observed campaign timeline (2025–2026), and recommended mitigations such as using private registries, configuring --ignore-scripts, and updating npm.