{"data":{"id":"c5bca5ee-f9de-408a-b5ea-c43fc4d1728a","title":"Claimed Bug Bounty Hunter Likely Used LLM to Build PhantomRaven npm Stealer","summary":"CrowdStrike assessed with high confidence that a financially motivated threat actor likely used a large language model to write PhantomRaven, a JavaScript information stealer distributed through more than 100 typosquatted and slopsquatted npm packages. The packages retrieve a remote dynamic dependency that harvests developer email addresses, CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins and CircleCI, system fingerprints including the public IP address, and Git/npm configuration details, then sends them to an attacker-controlled server. The operator, active since November 2022, appears to use the stolen data to find bug bounty opportunities rather than selling it.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://thehackernews.com/2026/09/claimed-bug-bounty-hunter-likely-used.html","publishedAt":"2026-09-18T09:18:03.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Google"],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-18T09:18:03.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":["AML.T0010"]}}