Malicious npm Package Stole Files From Claude AI User Directory via GitHub
A malicious npm package uploaded files from Claude’s user directory to a threat actor-controlled GitHub repo. OX Security says it abused postinstall code and stolen tokens.
Intelligence analysis by GPT-5.4 Mini
Researchers found a rogue npm package, `mouse5212-super-formatter`, that hid file theft behind fake sync and diagnostics behavior. It targeted Claude’s `/mnt/user-data` area, used GitHub access tokens to create or reuse repos, and uploaded local files to attacker-controlled storage.
A bad package was put into a place where developers download helpful code. But hidden inside it was a trick that copied files from a special Claude folder and sent them to a GitHub account the attacker controlled.
It acted like a fake helper tool. That is like a box labeled “toy cleaner” that secretly carries toys out of the house instead.
The scary part is that one small piece of code can reach into a computer, grab files, and send them away before anyone notices. That is why downloads from software stores have to be checked carefully.
Analysis
What the package did
OX Security says the npm package mouse5212-super-formatter was designed to collect files from /mnt/user-data, a directory used by Anthropic’s Claude tool for uploads and outputs in the background. The package is still downloadable from npm and was estimated to have 676 downloads, though the number of real installs is unclear.
How the theft worked
The researchers say the package posed as an internal "archive deployment sync" utility. During the postinstall stage, it tried to authenticate to GitHub using a token from the victim’s environment, or a hard-coded fallback token if none was available. It then checked whether a target repository existed, created one if needed, and recursively uploaded local files into a threat actor-controlled GitHub account.
To make the activity look less suspicious, the malware also wrote a fake "network connections" log that implied it was only collecting diagnostics. The stolen data was placed in randomly named folders so the operator could separate different theft sessions.
Why the campaign stood out
OX noted that the linked GitHub account is no longer available, but it was created on May 26, 2026, only hours before the first malicious version was uploaded to npm. The researchers also said the package exposed details of the attacker’s GitHub account, including a private token, suggesting weak operational security. They argued this may be a sign that AI is lowering the effort needed to produce malware, even if the result is still messy and easily uncovered.
Key points
- OX Security found a malicious npm package named `mouse5212-super-formatter`.
- The package targeted `/mnt/user-data`, a directory used by Claude for uploads and outputs.
- It ran in `postinstall`, used GitHub tokens, and uploaded files to an attacker-controlled repo.
- The malware disguised itself as a sync/diagnostics utility and wrote fake network logs.
- Researchers say the linked GitHub account was created hours before the malicious npm upload.
