Malicious npm Package Exfiltrated Claude User Files to Attacker GitHub Repo

Researchers identified a malicious npm package, mouse5212-super-formatter, that posed as an internal archive deployment synchronization utility but acted as an infostealer during its postinstall phase. The package searched the /mnt/user-data directory used by Anthropic's Claude AI environment for uploads and outputs, then recursively exfiltrated files to a threat actor-controlled GitHub repository through the GitHub Contents API. To reduce suspicion, it also generated a fake network connections log that made its activity appear diagnostic.

OX Security said the package had been downloaded about 676 times on npm, although confirmed compromises were limited, and researchers observed roughly seven exfiltration instances in the attacker repository before it was removed, most believed to be operator testing. The malware authenticated with either an environment token or a hardcoded private GitHub token, and that exposed token helped investigators trace the campaign; the attacker account had been created only hours before the first malicious release and was later deleted. Researchers dubbed the activity "Malware-Slop" and warned users to revoke GitHub access tokens and treat files stored in /mnt/user-data as potentially compromised.