Threat Actor Leveraged AI to Craft PhantomRaven npm Stealer, Researchers Say

Security researchers have traced a financially motivated threat actor to the creation and distribution of a JavaScript‑based credential‑stealing tool named PhantomRaven, which was published on the public npm package registry.

The analysis suggests the malicious code was likely generated with the assistance of a large language model, a finding that highlights the growing ease with which AI tools can be repurposed for illicit software development. investigators noted the coding style, repetitive patterns and rapid iteration typical of AI‑generated scripts, pointing to an automated workflow rather than a single handcrafted effort.

PhantomRaven masquerades as a legitimate npm module, allowing it to be installed alongside legitimate dependencies in Node.js projects. Once executed, the package harvests browser cookies, saved passwords and other sensitive data before exfiltrating the information to remote servers controlled by the attacker. Because npm is a default source for many JavaScript developers, the stealer can reach a broad audience with minimal friction.

The campaign appears to be financially driven, with the threat actor monetizing stolen credentials on underground markets. Researchers observed that the same actor has previously published other low‑profile malicious packages, indicating a systematic approach to exploiting the open‑source supply chain. The use of AI to write the malware reduces development time and may help the actor evade detection by constantly altering code signatures.

Industry experts warn that the incident underscores a widening attack surface in software ecosystems that rely on third‑party code. While npm implements automated scanning and manual review, the sheer volume of packages makes comprehensive vetting challenging. Security teams are urged to adopt stricter dependency management practices, such as pinning exact versions, employing software‑bill of materials, and integrating runtime monitoring tools.

Going forward, the security community expects more adversaries to adopt generative AI for crafting malicious payloads, prompting calls for improved detection mechanisms that can identify AI‑generated patterns. Meanwhile, developers are advised to scrutinize newly added dependencies, verify publisher reputations, and keep their development environments up to date to mitigate the risk of inadvertent infection.