Malicious npm package stole Claude AI files to GitHub

OX Security researchers Moshe Siman Tov Bustan and Nir Zadok reported that a malicious npm package named ‘mouse5212-super-formatter’ copied files from the /mnt/user-data directory used by Anthropic’s Claude AI and uploaded them to an attacker-controlled GitHub repository. The activity has been tracked under the label Malware-Slop.

The package presented itself as an internal ‘archive deployment sync’ utility. During the postinstall stage it attempted to authenticate to GitHub using a token found in the installation environment or a hard-coded fallback token. If authentication succeeded it checked for a target repository, created one if none existed, and then recursively synchronized local files into the remote repository.

Researchers said the malware specifically targeted the /mnt/user-data folder where Claude stores uploaded files and background outputs. Stolen files were placed in randomly named folders on the attacker repository. The package also created a decoy ‘network connections’ log file to give the impression it was only reporting diagnostics.

OX Security traced a linked GitHub account to May 26, 2026; the account was created hours before the first malicious package version appeared on npm. The GitHub account is no longer available. The package remains on the npm registry and has been downloaded an estimated 676 times, though researchers said the number of actual installs is unclear.

The package contained details tied to the operator’s GitHub account, including a private token. OX Security wrote: ‘Now that the bar to create malicious code was reduced significantly, we’re going to see more threat actors getting into the game – uploading more sloppy malwares, mostly mimicking APT groups to get a slice of the cake until npm starts automatically blocking malware completely.’

OX Security recommended that development and security teams audit package behavior, avoid storing broad-scope tokens in installation environments, restrict token permissions, and monitor accounts for unexpected repository creation or file uploads.