PhantomRaven npm Stealer Built With LLM Targets Dev Secrets
A threat actor operating under bug bounty personas deployed over 100 malicious npm packages containing an LLM-generated JavaScript stealer, PhantomRaven, targeting developer credentials and CI/CD secrets. CrowdStrike assessed with high confidence that the malware was written using a large language model, evidenced by verbose comments, placeholder code, and statistical token-analysis patterns. The operation highlights the growing use of AI-assisted malware development to lower the technical barrier for financially motivated attackers.