AI Risk Wire

Cases › security breach › LR-2026-0756

AI-generated PhantomRaven npm stealer linked to bug bounty hunter

Confirmed Why: 3 independent outlets · 3 independent reports

Status: fix reported

Severity moderate
Reported 16 Sep 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

CrowdStrike linked the PhantomRaven information stealer, distributed through npm packages designed to resemble developer tools, to a self-described bug bounty hunter. The packages carried a dependency fetched over HTTP, and a preinstall script ran during installation. The malware collected system details, usernames, email addresses and CI/CD environment variables and sent them to operator-controlled infrastructure. CrowdStrike assessed with high confidence that the code was generated with a large language model. The campaign was first exposed by Koi Security in October 2025, with later waves reported by Endor Labs. CrowdStrike found no sign that stolen logs were sold and assessed the operator likely used the information for bug bounty claims. The package owner denied malicious intent, saying the collection was meant to show supply-chain weaknesses for responsible disclosure.

What happened

1 · What it was doingNpm packages resembling developer tools were published to deliver the PhantomRaven stealer.
2 · What went wrongOn install, a preinstall script ran and the payload collected system details, usernames, emails and CI/CD variables.
3 · What it reached or didCollected data was sent to operator-controlled servers over HTTP GET and POST requests.
4 · How it was caughtCrowdStrike's Falcon Complete team responded to and remediated multiple incidents and identified the delivery packages.

What was done

CrowdStrike assessed the operator likely built the malware to find assets and opportunities for bug bounty claims.
Fix reported

“npm 12 stops dependency lifecycle scripts unless explicitly allowed and blocks dependencies hosted at remote URLs by default.”

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week
Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 5 items from the primary sources

What happened, in order

  1. 2025-10 Koi Security first exposed PhantomRaven.
  2. 2025-08 The individual claimed remote code execution against another target via a malicious npm package.
  3. 2025-11 The operator contacted a potential victim and claimed a compromised device found through dependency confusion.
  4. between November 2025 and February 2026 Endor Labs found 88 more packages distributed in three subsequent waves.
  5. July 2026 npm 12 was released and makes this delivery method harder to use.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-09-16
D inferred by us from the described behaviour, reason shown
Who caught it
an outside party
C one secondary source states it
What was done
npm 12 stops dependency lifecycle scripts unless explicitly allowed and blocks dependencies hosted at remote URLs by default.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK06
D inferred by us from the described behaviour, reason shown
secondary risks
RK04
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown

Notes on gaps

No date of occurrence is stated; the disclosure date is the press date of the first source, not a date given in its text. Control outcomes for G3 and E3 are my inference from the sources describing the packages as delivering a remote dependency with a preinstall script running.

LR-2026-0756 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON