PhantomRaven: LLM-Generated npm Infostealer Masquerading as Bug Bounty Research — Detection and Response Guide

---
title: Suspicious Child Process Spawned by npm or Node During Package Install
id: 3f9c1a72-8b4e-4d6a-9c21-7e5f2a8b0d34
status: experimental
description: Detects npm/node processes spawning shells, download utilities, or script interpreters — consistent with malicious package lifecycle hooks (preinstall/postinstall) such as those used in the PhantomRaven npm infostealer campaign.
references:
  - https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.supply_chain_compromise
  - attack.t1195.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - A small number of legitimate packages use install scripts for native module compilation (node-gyp); tune against known build tooling in your environment and scope to developer/CI assets.
level: high
---
title: Node.js Process Accessing Developer Credential Stores
id: 8a2d4e61-5f3b-4c79-b812-0d9e6a1c4f27
status: experimental
description: Detects node/npm processes reading credential and token files targeted by PhantomRaven-class infostealers, including .npmrc, git credential stores, SSH keys, and cloud CLI credentials.
references:
  - https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
      - '\npm.cmd'
  selection_target:
    TargetFilename|contains:
      - '\.npmrc'
      - '\.git-credentials'
      - '\.aws\credentials'
      - '\.azure\'
      - '\.ssh\id_'
      - '\.kube\config'
      - '\.docker\config.json'
  condition: selection_image and selection_target
falsepositives:
  - Legitimate npm CLI operations read .npmrc for registry authentication; investigate correlation with install activity and outbound connections from the same process tree.
level: high
---
title: Node.js Outbound Connection to Non-Registry Destination
id: c47b9e05-1a6d-4e83-af29-5b3d7c2e8f60
status: experimental
description: Detects node/npm processes establishing outbound connections to destinations other than known package registries and local development endpoints — potential staged payload retrieval or credential exfiltration during install.
references:
  - https://www.crowdstrike.com/en-us/blog/phantomraven-llm-generated-information-stealer-for-bug-bounty-hunting/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
    Initiated: 'true'
  filter_registries:
    DestinationHostname|endswith:
      - 'registry.npmjs.org'
      - 'registry.yarnpkg.com'
      - 'npmjs.com'
      - 'github.com'
      - 'nodejs.org'
  filter_local:
    DestinationIp|startswith:
      - '127.'
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not 1 of filter_*
falsepositives:
  - Local development servers and frameworks (React dev server, webpack, Next.js) make frequent connections; scope this rule to build servers and CI runners where node egress should be registry-only, or maintain an allowlist of approved internal artifact hosts.
level: medium

// Hunt 1: npm/node spawning shells or download tools during install (MDE)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "node", "npm.cmd", "npm.exe")
   or InitiatingProcessCommandLine has_any ("npm install", "npm ci", "npm i ", "yarn add", "pnpm add", "pnpm install")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe",
                      "certutil.exe", "bitsadmin.exe", "mshta.exe", "wscript.exe",
                      "cscript.exe", "rundll32.exe", "bash", "sh")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: node processes touching credential stores (MDE)
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "node", "npm.cmd")
| where FolderPath has_any (".npmrc", ".git-credentials", ".aws", ".azure", ".ssh", ".kube", ".docker")
   or FileName in~ (".npmrc", ".git-credentials", "credentials", "id_rsa", "id_ed25519", "config.json")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine,
          FolderPath, FileName, ActionType
| order by TimeGenerated desc;

// Hunt 3: node egress from build/CI assets excluding known registries (MDE)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("node.exe", "node", "npm.cmd")
| where not(RemoteUrl has_any ("registry.npmjs.org", "registry.yarnpkg.com", "npmjs.com", "github.com", "nodejs.org"))
| where not(RemoteIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.16." or RemoteIP == "127.0.0.1")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
| order by Connections desc

-- Hunt for malicious npm lifecycle scripts in package.json files across developer systems
-- and live node processes with suspicious command lines

-- Part 1: Find package.json files declaring install hooks that invoke shells, downloaders, or remote URLs
SELECT FullPath,
       read_file(filename = FullPath, length = 200000) AS PackageJson
FROM glob(globs = ["/home/*/**/package.json",
                   "/root/**/package.json",
                   "/opt/**/package.json",
                   "C:/Users/*/**/package.json"])
WHERE PackageJson =~ '"(preinstall|postinstall|install)"\\s*:'
  AND PackageJson =~ '(?i)(curl |wget |powershell|invoke-webrequest|iex |base64|https?://)'

-- Part 2: Enumerate running node/npm processes with suspicious command lines
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(node|npm)'
  AND CommandLine =~ '(?i)(curl|wget|powershell|iex|invoke-webrequest|base64|https?://)'

-- Part 3: Check live network connections from node processes
SELECT Pid, Name, Pid AS ProcessPid, Status, Family, Address, Port
FROM netstat()
WHERE Name =~ '(?i)node'
  AND Status =~ 'ESTABLISHED'

#!/bin/bash
# PhantomRaven-class malicious npm package audit & hardening script
# Run on developer workstations and CI/CD build agents (Linux/macOS)
# Review output before taking destructive actions.

set -euo pipefail
REPORT="phantomraven_audit_$(date +%Y%m%d_%H%M%S).log"
echo "=== PhantomRaven npm Supply-Chain Audit ===" | tee "$REPORT"

# --- 1. Find package.json files with install lifecycle hooks ---
echo -e "\n[1] package.json files containing preinstall/install/postinstall hooks:" | tee -a "$REPORT"
find "$HOME" /opt /srv /workspace /builds 2>/dev/null -name "package.json" \
  -not -path "*/node_modules/*" | while read -r f; do
    if grep -Eq '"(preinstall|install|postinstall)"[[:space:]]*:' "$f"; then
      echo "  HOOK FOUND: $f" | tee -a "$REPORT"
      grep -E '"(preinstall|install|postinstall)"[[:space:]]*:' "$f" | tee -a "$REPORT"
    fi
done

# --- 2. Flag lifecycle hooks invoking download tools or remote URLs ---
echo -e "\n[2] Lifecycle hooks invoking curl/wget/base64/remote URLs (HIGH RISK):" | tee -a "$REPORT"
find "$HOME" /opt /srv /workspace /builds 2>/dev/null -name "package.json" | while read -r f; do
  if grep -Eq '"(preinstall|install|postinstall)"' "$f" && \
     grep -Eiq '(curl |wget |base64|https?://)' "$f"; then
    echo "  SUSPICIOUS: $f" | tee -a "$REPORT"
  fi
done

# --- 3. Globally disable lifecycle script execution for npm ---
echo -e "\n[3] Enforcing ignore-scripts=true in user npm config..." | tee -a "$REPORT"
npm config set ignore-scripts true
npm config get ignore-scripts | tee -a "$REPORT"
echo "  NOTE: Some native modules (node-gyp, esbuild, sharp) legitimately need install scripts." | tee -a "$REPORT"
echo "  Re-enable per-project only after vetting: npm install --ignore-scripts=false" | tee -a "$REPORT"

# --- 4. Check for exposed tokens in .npmrc ---
echo -e "\n[4] Checking for stored npm auth tokens:" | tee -a "$REPORT"
for rc in "$HOME/.npmrc" /usr/local/etc/npmrc /etc/npmrc; do
  if [ -f "$rc" ] && grep -q "_authToken" "$rc"; then
    echo "  TOKEN STORED IN: $rc" | tee -a "$REPORT"
    echo "  ACTION: Revoke and rotate this token at https://www.npmjs.com/settings/<user>/tokens" | tee -a "$REPORT"
  fi
done

# --- 5. Check git credential store for plaintext credentials ---
echo -e "\n[5] Checking for plaintext git credentials:" | tee -a "$REPORT"
if [ -f "$HOME/.git-credentials" ]; then
  echo "  PLAINTEXT CREDENTIALS: $HOME/.git-credentials — rotate any stored PATs immediately." | tee -a "$REPORT"
else
  echo "  No ~/.git-credentials file found. OK." | tee -a "$REPORT"
fi

# --- 6. Verify lockfile integrity (unexpected dependency changes) ---
echo -e "\n[6] Checking for uncommitted lockfile changes in git repos:" | tee -a "$REPORT"
find "$HOME" /opt /srv /workspace 2>/dev/null -maxdepth 4 -name "package-lock.json" | while read -r lock; do
  repo_dir=$(dirname "$lock")
  if [ -d "$repo_dir/.git" ]; then
    if ! git -C "$repo_dir" diff --quiet -- "package-lock.json" 2>/dev/null; then
      echo "  LOCKFILE MODIFIED (review!): $lock" | tee -a "$REPORT"
    fi
  fi
done

echo -e "\n=== Audit complete. Review $REPORT and rotate any exposed credentials. ===" | tee -a "$REPORT"