As cited
Copy frozen at (site build).
threat intel
Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer
A financially motivated threat actor distributed PhantomRaven, a JavaScript information stealer, through the npm package registry. Security analysis indicates high confidence the malware was written using a large language model, based on verbose comments, placeholder code, and statistical token patterns.
Why it matters: Developers using npm must audit their dependencies immediately for PhantomRaven, as this stealer can harvest sensitive data from applications and build environments.
- Source published
- First seen by Cybersecurity Tracker