'Bug Bounty Hunter' Caught Using LLM-Generated Malware in Massive npm Supply Chain Attack

A threat actor active since November 2022 is distributing a JS-based information stealer dubbed PhantomRaven via the npm package registry to scrape developer credentials. The attacker uploaded more than 100 typosquatted packages designed to silently steal CI/CD secrets from environments like GitHub Actions, GitLab CI, and Jenkins. CrowdStrike $CRWD noted the malware retrieves a remote dynamic dependency to evade detection by standard security tools. The operator has collected bounties from at least 9 organizations across tech and retail, using the compromised access as extortion for payouts rather than selling logs on dark web shops. "The developer likely wrote the malware using a large language model (LLM), an assessment made with high confidence based on verbose comments, placeholder code, and statistical token-analysis patterns." — CrowdStrike Counter Adversary Operations