PhantomRaven npm Campaign Tied to Single Operator Harvesting Secrets Solely for Bug Bounty Claims Since 2022

CrowdStrike analysis of token patterns, verbose placeholder comments, and statistical anomalies shows high-confidence LLM authorship in PhantomRaven's JavaScript. The operator maintained accounts jpdhellonpm1 and jpd15 to upload packages that fetch remote payloads scanning for Jenkins, GitLab, and GitHub Actions secrets. Activity traces to November 2022 with linked handles across PyPI attempts and prior npmhell identities. No stolen logs appear in known marketplaces.

The same actor publicly claimed RCE via a malicious package in August 2025 and listed bounties from nine firms in tech, retail, and hospitality. This creates an operational loop where supply-chain compromise directly feeds disclosure rewards. Mainstream coverage missed the pattern of using ethical programs as monetization after initial theft, plus the shift from commodity stealers to custom LLM-assisted tooling that evades static detection.

Registry operators must now implement behavioral checks for remote dependency fetches and LLM fingerprinting rather than relying on known-bad lists. Similar campaigns are likely expanding to PyPI and other language ecosystems as generation costs drop. Independent verification of attribution remains limited to code artifacts; no public technical indicators confirm state involvement or larger groups.