TLDR Tech / InfoSec
PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting (6 minute read)
PhantomRaven, an LLM-generated JavaScript information stealer, was created by a bug bounty hunter and spread via typosquatted npm packages. It extracts OS, network, Git/npm credentials, and CI/CD environment variables from platforms like GitHub Actions and GitLab CI, then sends data via HTTP. The attacker used this to file bug bounty claims. Npm 12+ now blocks preinstall scripts by default; using `--ignore-scripts` and a private registry can mitigate this threat.
Read the full story