Malware

mouse5212-super-formatter

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

T1195Supply Chain CompromiseEvidence2

ИБ-специалисты компании OX Security обнаружили в npm вредоносный пакет mouse5212-super-formatter, который маскировался под служебную утилиту для синхронизации данных с GitHub.

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

OX Security researchers have discovered mouse5212-super-formatter, a malicious npm package acting as an infostealer.

Execution

1 technique

T1059.007JavaScriptEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback), checks whether a target repository exists, creates it if needed, then recursively walks a local directory and uploads every file through the GitHub Contents API.

Persistence

1 technique

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

Передача информации дополнительно маскировалась под отправку диагностических сведений: вредонос генерировал фиктивные логи сетевой активности и создавал впечатление, будто занимается обычным мониторингом системы.

T1036MasqueradingEvidence4

Автор малвари пытался выдать свой пакет за инструмент для проверки репозиториев, сбора диагностической информации и синхронизации рабочих файлов.

T1070Indicator RemovalEvidence1

The malware also wrote a fake “network connections” log during execution, designed to make the activity look like routine diagnostics rather than data theft.

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence3

После установки вредонос авторизовывался на GitHub, используя либо токен из переменных окружения жертвы, либо встроенный в код резервный токен.

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

performs a structured synchronization of local workspace files into a remote tracking tree ... and then recursively uploads every file

Collection

3 techniques

T1005Data from Local SystemEvidence4

По данным исследователей, вредонос нацеливался на содержимое директории /mnt/user-data. Именно этот каталог используется Claude для хранения загруженных файлов, результатов работы и других данных.

T1119Automated CollectionEvidence2

...then recursively walks a local directory and uploads every file through the GitHub Contents API.

T1560Archive Collected DataEvidence1

The data itself was encoded in base64 during the exfiltration process, a basic obfuscation technique to disguise the outgoing content.

Command and Control

1 technique

T1132Data EncodingEvidence2

It stores the stolen files under random per-run folder names, which allows for multiple stealing sessions, and exfiltrates the sensitive info using base64 encoding.

Exfiltration

2 techniques

T1567Exfiltration Over Web ServiceEvidence3

The malware authenticated to GitHub using either an environment token or the hardcoded fallback and checked whether a target repository existed, creating one if it did not. It then walked through the local “/mnt/user-data” directory recursively and uploaded every file it found using the GitHub Contents API.

T1567.001Exfiltration to Code RepositoryEvidence2

Если такого репозитория не существовало, вредонос создавал его автоматически и начинал рекурсивно выгружать данные жертвы через GitHub Contents API.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

xakepNews

May 29, 2026

Создатель вредоносного npm-пакета случайно слил собственные данные - Хакер

Malicious npm package masquerading as a GitHub data synchronization utility. It targeted Claude users by stealing data from /mnt/user-data, authenticating to GitHub with victim or embedded tokens, creating or using repositories to store stolen data, and exfiltrating files via the GitHub Contents API while disguising activity as diagnostic logging.

cyber security newsNews

May 28, 2026

AI-Generated npm Malware Accidentally Exposes Threat Actor’s Private GitHub Token

A malicious npm package masquerading as an internal utility that recursively scans the /mnt/user-data directory and exfiltrates discovered files to a remote GitHub repository via the GitHub Contents API, using base64 encoding and fake diagnostic logging to reduce suspicion.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

mouse5212-super-formatter

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

T1195Supply Chain CompromiseEvidence2

T1195.001Compromise Software Dependencies and Development ToolsEvidence1

OX Security researchers have discovered mouse5212-super-formatter, a malicious npm package acting as an infostealer.

Execution

1 technique

T1059.007JavaScriptEvidence1

Persistence

1 technique

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence4

T1070Indicator RemovalEvidence1

The malware also wrote a fake “network connections” log during execution, designed to make the activity look like routine diagnostics rather than data theft.

T1078Valid AccountsEvidence1

In reality, in the post installation stage, it authenticates to GitHub (using an environment token or a hardcoded fallback)

Credential Access

1 technique

T1649Steal or Forge Authentication CertificatesEvidence3

Discovery

1 technique

T1083File and Directory DiscoveryEvidence1

performs a structured synchronization of local workspace files into a remote tracking tree ... and then recursively uploads every file

Collection

3 techniques

T1005Data from Local SystemEvidence4

T1119Automated CollectionEvidence2

...then recursively walks a local directory and uploads every file through the GitHub Contents API.

T1560Archive Collected DataEvidence1

The data itself was encoded in base64 during the exfiltration process, a basic obfuscation technique to disguise the outgoing content.

Command and Control

1 technique

T1132Data EncodingEvidence2

It stores the stolen files under random per-run folder names, which allows for multiple stealing sessions, and exfiltrates the sensitive info using base64 encoding.

Exfiltration

2 techniques

T1567Exfiltration Over Web ServiceEvidence3

T1567.001Exfiltration to Code RepositoryEvidence2

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

xakepNews

May 29, 2026

Создатель вредоносного npm-пакета случайно слил собственные данные - Хакер

cyber security newsNews

May 28, 2026

AI-Generated npm Malware Accidentally Exposes Threat Actor’s Private GitHub Token

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.