Hacker Uses AI-Generated PhantomRaven Malware to Steal Developer Secrets via npm

A hacker built a sneaky data-stealing tool called PhantomRaven. He likely used an AI chatbot to write the code. Cybersecurity firms shared this finding in a new report this week. The report says PhantomRaven spread through npm, a popular hub where coders download free software building blocks.

Researchers first spotted this threat months ago. Koi Security found the campaign back in October 2025. The team noticed something odd. Some code packages kept reaching out to the same strange website during setup. That website secretly delivered the harmful script.

How the Hidden Script Steals Your Data

The attacker uploaded more than 100 fake packages to npm. Many carried names close to real, trusted tools. This trick is called typosquatting. A tired coder might grab the wrong package by mistake and install it without noticing.

These packages looked safe at first glance. They listed no risky links to other code. Security scanners usually check those links to catch threats. But this trick fooled them. The real danger hid on an outside server instead.

Once a coder installed one of these fake packages, the script fetched extra code from that outside server. This step is called a remote dynamic dependency. It lets the attacker sneak past security tools built to sniff out bad code sitting inside a package.

After that step, the hidden script sprang into action. It hunted for email addresses on the coder’s computer. It also grabbed details about the coder’s CI/CD setup. CI/CD tools help teams build and test software automatically, and they often hold private keys.

The script also collected a fingerprint of the whole system. This fingerprint included the victim’s public IP address. On top of that, it grabbed usernames tied to Git and npm accounts. It pulled login secrets from GitHub Actions, GitLab, Jenkins, and CircleCI too.

Tracing the Hacker’s Trail

The researcher says this same operator has stayed active since November 2022. He calls himself a bug bounty hunter online. Bug bounty programs pay coders cash rewards for finding software flaws and reporting them the right way.

Public posts show the hacker claims he collected rewards from at least nine companies. These firms span the tech, retail, and hotel industries. He used well-known bounty platforms like HackerOne, Bugcrowd, and Intigriti to submit his findings.

The expert checked the usual dark web shops where stolen data gets sold. The firm found no trace of PhantomRaven’s stolen data for sale there. This detail matters a lot. It hints the hacker may not sell the data at all.

Instead, researchers believe he breaks into company systems first. Then he studies what he stole. After that, he reports a made-up bug to the victim company and claims a cash reward. In short, the theft itself becomes his proof of a flaw worth paying for.

Two npm accounts linked to this scheme were named jpdhellonpm1 and jpd15. Both accounts pushed packages carrying the PhantomRaven script. Npm has since shut down both accounts. Several other online names tie back to the same person too, including jpd12, jpd13, and npmhell.

One outside researcher, Maddie Stewart, looked into the hacker’s claims from August. According to her findings, the hacker said he had found a serious flaw letting him run code remotely on a victim’s machine. He explained that a hidden setup script on the victim’s computer made this possible.

Signs also point to the same hacker testing similar tricks on PyPI. PyPI is a package hub built for the Python programming language. This move suggests he wants his scheme to spread beyond just JavaScript projects.

Attackers can also abuse trusted software components to reach websites from another direction. In a separate case, hackers poisoned the BdThemes API to hijack WordPress websites through admin sessions, showing how compromised third-party infrastructure can become an entry point for website attacks.

AI Tools Are Reshaping Cybercrime

Researchers grew confident about the AI angle after studying the malware’s code closely. The script contained long, chatty comments. It also held leftover placeholder text that real programmers rarely leave behind. Statistical patterns in the code’s wording matched typical AI writing styles too.

This case fits a bigger pattern. More criminals now lean on AI chatbots to write malicious code faster. A hacker no longer needs deep coding skills to build a working attack tool. AI can fill that gap in minutes.

The researcher noted that most criminals just rent ready-made hacking tools instead of building their own. This hacker chose a different path. He built his own custom tool, then used stolen access as leverage inside legitimate bounty programs.

Coders should stay careful when picking packages to install. Always double-check a package name before downloading it. Watch for typos in the name, since those slight changes often signal danger. Keep an eye on unusual network activity during installs too, since that can flag a hidden threat early.