Researchers have linked a financially motivated threat actor to PhantomRaven, a JavaScript-based information stealer distributed through the npm package registry. The actor reportedly claimed to be a bug bounty hunter, but the assessment points to financial gain as the underlying motive.
The malware's developer likely used a large language model to write the code, according to the analysis. This case highlights how LLMs can lower the barrier for creating malicious software, even for attackers with limited coding skill.
Because the stealer was published on npm, a widely used JavaScript package manager, it could have been inadvertently installed by developers. The report does not specify the package name or how many times it was downloaded.