{"schema_version":"0.10.0","id":"LR-2026-0756","record_version":1,"title":"AI-generated PhantomRaven npm stealer linked to bug bounty hunter","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":56.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":2.88,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"3 independent outlets","original_document":null,"reports_total":3,"reports_independent":3,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"3 independent outlets"}]},"sources_hash":"c39ffb5e78fee7d35225fac78b7cfb5a7acbe51af8c2fe830834cef81792c1d1"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-09-16","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"CrowdStrike linked the PhantomRaven information stealer, distributed through npm packages designed to resemble developer tools, to a self-described bug bounty hunter. The packages carried a dependency fetched over HTTP, and a preinstall script ran during installation. The malware collected system details, usernames, email addresses and CI/CD environment variables and sent them to operator-controlled infrastructure. CrowdStrike assessed with high confidence that the code was generated with a large language model. The campaign was first exposed by Koi Security in October 2025, with later waves reported by Endor Labs. CrowdStrike found no sign that stolen logs were sold and assessed the operator likely used the information for bug bounty claims. The package owner denied malicious intent, saying the collection was meant to show supply-chain weaknesses for responsible disclosure.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"npm 12 stops dependency lifecycle scripts unless explicitly allowed and blocks dependencies hosted at remote URLs by default.","precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK04"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://hackread.com/crowdstrike-ai-phantomraven-malware-bug-bounty-hunter/","publisher":"Hackread","date":"2026-09-16","type":"press","title":"CrowdStrike Links AI-Generated PhantomRaven Malware to Bug Bounty Hunter - Hackread","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://securitybrief.com.au/story/crowdstrike-links-phantomraven-malware-to-bug-bounty-hunter","publisher":"SecurityBrief Australia","date":"2026-09-16","type":"press","title":"CrowdStrike links PhantomRaven malware to bug bounty hunter - SecurityBrief Australia","archived_url":null,"independence":"independent"},{"url":"https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html","publisher":"The Hacker News","date":"2026-09-18","type":"press","title":"Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer - The Hacker News","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","event.remediation":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"The malware, called PhantomRaven, is a JavaScript-based information stealer targeting developers and software development environments."}],"event.detection_method":[{"source_index":0,"quote":"CrowdStrike said its Falcon Complete team responded to and remediated multiple incidents involving the malware and identified packages used to deliver it."}],"event.remediation":[{"source_index":0,"quote":"Dependency lifecycle scripts no longer run unless explicitly allowed, while dependencies hosted at remote URLs are also blocked by default."}],"impact.severity":[{"source_index":0,"quote":"That investigation identified more than 126 malicious npm packages with over 86,000 downloads."}],"event.summary":[{"source_index":0,"quote":"PhantomRaven is delivered through npm packages designed to resemble legitimate developer tools."},{"source_index":0,"quote":"Instead, they specify a dependency using an HTTP URL."},{"source_index":0,"quote":"The downloaded package contains a preinstall script that executes during installation."},{"source_index":0,"quote":"The information is sent to operator-controlled infrastructure through HTTP GET and POST requests."},{"source_index":0,"quote":"The company also assessed with high confidence that PhantomRaven’s code was generated using a large language model (LLM)."},{"source_index":0,"quote":"This use of remote dynamic dependencies was documented when Koi Security first exposed PhantomRaven in October 2025."},{"source_index":0,"quote":"Researchers have not observed PhantomRaven logs being sold through criminal log markets."},{"source_index":0,"quote":"When Endor Labs investigated later PhantomRaven waves earlier this year, the package owner contacted researchers and denied malicious intent."}]},"notes_on_gaps":"No date of occurrence is stated; the disclosure date is the press date of the first source, not a date given in its text. The sources do not name the model or its developer, and no autonomous agent is described, so agent_involved, failure_class and autonomy fields are left out. No victim count, loss, records or reversibility is stated for this incident; the 126-package and 86,000-download figures describe the wider PhantomRaven campaign, and severity moderate is my judgement from that stated scope. Trigger, root cause and detection of this specific operator are not stated and are left out. Attribution to one individual is CrowdStrike's assessment and is disputed by the package owner, who said the collection was for responsible disclosure; Endor Labs saw no evidence that secrets were exfiltrated, which I did not weigh against the harm class. Control outcomes for G3 and E3 are my inference from the sources describing the packages as delivering a remote dependency with a preinstall script running. The npm 12 change is from a source that is not the implicated party, so it is recorded as a remediation statement, not as a fix by the implicated party. Country is not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (3 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Npm packages resembling developer tools were published to deliver the PhantomRaven stealer.","quote":"PhantomRaven is delivered through npm packages designed to resemble legitimate developer tools.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"On install, a preinstall script ran and the payload collected system details, usernames, emails and CI/CD variables.","quote":"The downloaded package contains a preinstall script that executes during installation.","source_index":0,"grade":"C"},{"step":"reached","text":"Collected data was sent to operator-controlled servers over HTTP GET and POST requests.","quote":"The information is sent to operator-controlled infrastructure through HTTP GET and POST requests.","source_index":0,"grade":"C"},{"step":"caught","text":"CrowdStrike's Falcon Complete team responded to and remediated multiple incidents and identified the delivery packages.","quote":"CrowdStrike said its Falcon Complete team responded to and remediated multiple incidents involving the malware and identified packages used to deliver it.","source_index":0,"grade":"C"},{"step":"done","text":"CrowdStrike assessed the operator likely built the malware to find assets and opportunities for bug bounty claims.","quote":"CrowdStrike therefore assesses that the operator likely developed the malware to compromise company assets and identify opportunities that could subsequently be submitted for bug bounty rewards.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://hackread.com/crowdstrike-ai-phantomraven-malware-bug-bounty-hunter/","https://securitybrief.com.au/story/crowdstrike-links-phantomraven-malware-to-bug-bounty-hunter","https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html"]},"analysis":{"sections":{"timeline":[{"text":"Koi Security first exposed PhantomRaven.","quote":"This use of remote dynamic dependencies was documented when Koi Security first exposed PhantomRaven in October 2025.","source_index":0,"when":"2025-10"},{"text":"The individual claimed remote code execution against another target via a malicious npm package.","quote":"CrowdStrike also found that, in August 2025, the same individual claimed to have achieved remote code execution against another target using a malicious npm package, although the company said it could not independently verify that claim.","source_index":0,"when":"2025-08"},{"text":"The operator contacted a potential victim and claimed a compromised device found through dependency confusion.","quote":"In November 2025, the operator contacted a potential victim and claimed to have discovered a compromised device through a dependency-confusion attack involving malicious npm packages.","source_index":0,"when":"2025-11"},{"text":"Endor Labs found 88 more packages distributed in three subsequent waves.","quote":"Later research from Endor Labs found another 88 packages distributed in three subsequent waves between November 2025 and February 2026.","source_index":0,"when":"between November 2025 and February 2026"},{"text":"npm 12 was released and makes this delivery method harder to use.","quote":"The same delivery method is harder to use with npm 12, released in July 2026.","source_index":0,"when":"July 2026"}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://hackread.com/crowdstrike-ai-phantomraven-malware-bug-bounty-hunter/","https://securitybrief.com.au/story/crowdstrike-links-phantomraven-malware-to-bug-bounty-hunter","https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html"]}}