A threat actor, motivated by financial gain, has been identified as the creator of PhantomRaven, a JavaScript-based information stealer distributed through the npm package registry. Researchers believe the malware's development involved a large language model, as indicated by its unusual coding style, which includes verbose comments and placeholder code. This type of malware can potentially steal sensitive information from users who inadvertently install the malicious package. As npm is widely used by developers, this incident raises significant concerns about the security of open-source software repositories and the risks they pose to end users. It highlights the need for vigilance in monitoring package integrity and the potential for automated tools to assist in malicious software creation.