Loading story…
Researchers identified a malicious npm package, mouse5212-super-formatter, that posed as an internal archive deployment synchronization utility but acted as an infostealer during its postinstall phase. The package searched the /mnt/user-data directory used by Anthropic's Claude AI environment for uploads and outputs, then recursively exfiltrated files to a threat actor-controlled GitHub repository through the GitHub Contents API. To reduce suspicion, it also generated a fake network connections log that made its activity appear diagnostic.
OX Security said the package had been downloaded about 676 times on npm, although confirmed compromises were limited, and researchers observed roughly seven exfiltration instances in the attacker repository before it was removed, most believed to be operator testing. The malware authenticated with either an environment token or a hardcoded private GitHub token, and that exposed token helped investigators trace the campaign; the attacker account had been created only hours before the first malicious release and was later deleted. Researchers dubbed the activity "Malware-Slop" and warned users to revoke GitHub access tokens and treat files stored in /mnt/user-data as potentially compromised.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
A malicious npm package named "mouse5212-super-formatter" was uploaded to npm, masquerading as an internal archive deployment synchronization utility. Its postinstall behavior recursively collected files from "/mnt/user-data" and exfiltrated them to a GitHub repository.
OX Security said the GitHub account used in the campaign was later deleted after the attack. The deletion followed the repository activity used to store exfiltrated files.
Using the leaked GitHub private token, OX Security traced exfiltration activity in the attacker-controlled repository and observed about seven active exfiltration instances. Most of those instances were believed to be the threat actor’s own testing rather than confirmed victim installations.
OX Security reported that the attacker’s GitHub account was created only hours before the first malicious version of the npm package was uploaded. The account was later used to receive exfiltrated files from infected environments.
OX Security publicly disclosed the malicious npm package and dubbed the activity "Malware-Slop," describing how it targeted "/mnt/user-data" used by Anthropic's Claude AI tool for uploads and outputs. At disclosure, the package had an estimated 676 downloads and was still available on npm, though actual installations were unconfirmed.
The npm package page for "mouse5212-super-formatter" shows the package as deprecated, with an author message stating it is no longer supported and directing users to npm support for more information. This reflects a status change on the package listing after the earlier disclosure that it was still available on npm.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceox.security
Open sourcetheregister.com
Open sourcenpmjs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **software supply chain-style malware distribution** efforts abusing developer-adjacent platforms. JFrog detailed a malicious npm package, `@openclaw-ai/openclawai`, masquerading as an *OpenClaw* CLI installer; once executed, it uses a `postinstall` hook to reinstall globally and drop an obfuscated first-stage (`setup.js`) that deploys a multi-stage payload internally identified as **GhostLoader** (campaign tracked as **GhostClaw**). The malware is designed to persist and exfiltrate a broad set of sensitive data from developer workstations, including credentials (e.g., cloud config artifacts for **AWS/GCP/Azure**), macOS Keychain data, browser sessions, SSH keys, and cryptocurrency wallet/seed material. Separately, Trend Micro reported a large-scale distribution operation for the **BoryptGrab** information stealer via **100+ public GitHub repositories** that pose as legitimate tools and game cheats. The campaign uses SEO manipulation (keyword-stuffed READMEs and lookalike download pages) to drive victims from search results into redirect chains that ultimately deliver ZIP archives containing the stealer; some variants also deploy a PyInstaller backdoor (**TunnesshClient**) that establishes a reverse SSH tunnel for attacker communications. Reported indicators (e.g., Russian-language comments and related infrastructure) suggest a possible Russian nexus, and the observed targeting focuses on harvesting browser data, crypto wallets, system information, and user files.
Jun 29, 2026
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026
Threat actors used fake GitHub repositories themed around Anthropic's leaked **Claude Code** source to distribute malware to users searching for the exposed codebase. Researchers at Zscaler ThreatLabz said one repository, operated by user **`idbzoomh`**, promoted a supposed Claude Code leak with "unlocked enterprise features" and no restrictions, while search-engine optimization helped it rank for queries such as **"leaked Claude Code."** Victims who downloaded the offered archive received a Rust-based executable, **`ClaudeCode_x64.exe`**, instead of source code. The executable acted as a dropper for the **Vidar** information stealer and the **GhostSocks** proxy malware. The lure followed Anthropic's accidental exposure of a **59.8 MB** JavaScript source map in an npm package, which revealed roughly **513,000 lines** of unobfuscated TypeScript across **1,906 files** and exposed internal logic and security-related details. Zscaler also identified a second similar repository believed to be tied to the same actor, indicating an ongoing campaign that reportedly reached tens of thousands of users and mirrors recent malware delivery efforts built around fake developer-tool downloads.
Jun 29, 2026