Cybersecurity researchers have discovered a new malicious npm package designed to steal local files from developer environments, including data associated with Anthropic’s Claude AI tooling.
The package, named mouse5212-super-formatter, was published to the npm registry and has been linked to a campaign codenamed Malware-Slop by OX Security.
At first glance, the package presents itself as a utility for archive deployment and repository synchronization. In reality, it is an information stealer that attempts to collect local workspace files and upload them to a threat actor-controlled GitHub account.
The incident is another example of how attackers are increasingly targeting developer tools, AI-assisted workflows, and open-source package ecosystems.
What the Malicious Package Does
According to OX Security, the package is designed to upload files from:
/mnt/user-data
This directory is used by Anthropic’s Claude AI tooling to handle uploaded files and generated outputs in the background.
That makes the package especially concerning because AI workspaces can contain sensitive material such as:
- source code
- documents uploaded for analysis
- project notes
- configuration files
- generated outputs
- internal data samples
- credentials accidentally included in files
- customer or business data used during AI-assisted workflows
By targeting this directory, the malware appears to focus on data created or handled during AI-assisted development and analysis tasks.
Disguised as a Legitimate Sync Utility
The malware attempts to look like an internal archive deployment synchronization tool.
Researchers found that it pretends to validate or initialize a GitHub repository, capture a lightweight “network status” snapshot, and synchronize local workspace files into a remote tracking tree.
That description sounds harmless and technical enough to avoid suspicion.
But behind the scenes, the package performs unauthorized data collection and file exfiltration.
Its behavior includes:
- authenticating to GitHub during the postinstall stage
- using a GitHub token found in the victim’s environment
- falling back to a hard-coded GitHub token if needed
- checking whether a target repository exists
- creating the repository if it does not exist
- recursively uploading local files to an attacker-controlled GitHub account
The use of the postinstall stage is important because malicious code can run automatically when the package is installed.
That means a developer may not need to manually execute the package for the malware to begin operating.
GitHub Used as an Exfiltration Channel
Instead of sending stolen data to a traditional command-and-control server, the package uploads files to GitHub.
The stolen files are stored in randomly named folders, likely allowing the attacker to separate and track different victim sessions.
This technique can help attackers blend malicious activity into normal developer workflows. GitHub traffic is common in development environments, so data uploads may not immediately stand out unless organizations monitor unusual repository creation, token usage, or outbound GitHub activity.
The malware also writes a fake “network connections” log, apparently to make its behavior look like diagnostic reporting.
This is a deception technique. It gives users or defenders a benign explanation while hiding the actual purpose: unauthorized collection and remote transfer of local data.
Poor OPSEC Suggests AI-Assisted Malware Development
One notable detail is that the package reportedly leaked information about the attacker’s GitHub account, including a private token.
That points to poor operational security.
OX Security suggested that this may indicate the malware was generated or assisted by AI without the attacker fully understanding how to secure their own operation.
This is an important trend.
As generative AI lowers the barrier to creating working code, more low-skilled or opportunistic threat actors may be able to publish malicious packages. The result may be more “sloppy malware” that is technically functional but poorly built, poorly hidden, and operationally careless.
Even sloppy malware can still be dangerous if it steals sensitive files before being detected.
Why AI Workspaces Are Becoming Targets
The targeting of Claude-related workspace directories reflects a broader change in the threat landscape.
Developers and analysts increasingly use AI tools to review code, summarize documents, generate scripts, troubleshoot systems, and process business data. These workflows may involve uploading sensitive files into local or cloud-connected AI environments.
That creates a new attack surface.
AI workspaces may contain temporary files, working copies, generated outputs, and context that users assume is private or short-lived.
Attackers understand that these directories may contain valuable material, especially in developer environments where users frequently work with source code, credentials, internal documentation, and project data.
npm Remains a High-Risk Supply Chain Target
The npm ecosystem continues to be heavily targeted by attackers because it is widely used and easy to publish to.
Malicious npm packages often use tactics such as:
- typo-squatting
- dependency confusion
- postinstall scripts
- credential harvesting
- clipboard theft
- cryptocurrency wallet theft
- source code exfiltration
- browser data theft
- cloud credential theft
- hidden payload downloads
The Malware-Slop campaign fits into this pattern, but with a notable AI-focused twist: it targets files associated with Claude’s workspace handling.
This shows how attackers adapt quickly to new developer habits and popular AI tooling.
Why Developers Should Care
A malicious package installed during development can expose far more than one project.
Depending on the local environment, it may access:
- source code
.envfiles- SSH keys
- GitHub tokens
- npm tokens
- cloud credentials
- local configuration files
- AI workspace data
- documents uploaded for AI review
- generated scripts or outputs
If a developer machine is compromised, attackers may use stolen data to access repositories, publish malicious packages, compromise CI/CD pipelines, or move deeper into an organization.
Developer endpoints are now high-value targets because they sit at the intersection of code, credentials, automation, and business context.
What Developers Should Do
Developers should be cautious when installing unfamiliar npm packages, especially packages with low reputation, recent creation dates, vague descriptions, or unnecessary install scripts.
Recommended actions include:
- avoid installing unknown packages without review
- inspect package scripts before installation
- use
npm install --ignore-scriptswhen testing untrusted packages - check package ownership, age, and download patterns
- review source code before adding dependencies
- use dependency scanning tools
- avoid storing sensitive files in AI workspace directories
- keep secrets out of uploaded analysis files
- rotate tokens if suspicious packages were installed
- monitor unexpected GitHub repository creation or uploads
If mouse5212-super-formatter was installed, the system should be treated as potentially compromised.
What Organizations Should Review
Security teams should expand supply chain monitoring to cover AI-assisted developer workflows.
Recommended steps include:
- search endpoints and repositories for
mouse5212-super-formatter - review npm install logs and lockfiles
- monitor for access to
/mnt/user-data - review outbound GitHub activity from developer machines
- check for unexpected GitHub repositories or commits
- identify GitHub tokens used from unusual systems
- rotate exposed GitHub, npm, SSH, and cloud credentials
- scan AI workspace directories for sensitive files
- review endpoint telemetry for postinstall script execution
- enforce least privilege on developer tokens
- restrict package installation in sensitive environments
- use internal package mirrors or allowlists where possible
Organizations should also update developer security guidance to include AI workspace hygiene.
AI Tooling Changes the Data Exposure Model
The rise of AI coding assistants and analysis tools changes how sensitive data moves through development environments.
Files may be copied, uploaded, transformed, summarized, cached, or stored temporarily as part of an AI workflow. This creates new locations where sensitive information can accumulate.
Security programs should account for:
- local AI workspace directories
- temporary upload folders
- generated output directories
- AI assistant configuration files
- model context files
- plugin or extension storage
- browser-based AI session data
Attackers will continue looking for these locations because they may contain high-value data in less-protected places.
Final Thoughts
The Malware-Slop campaign shows how quickly attackers are adapting to AI-assisted development workflows.
The malicious npm package mouse5212-super-formatter may be poorly built and operationally sloppy, but its objective is clear: steal local workspace files and exfiltrate them through GitHub.
Its focus on Claude’s /mnt/user-data directory is a warning sign. AI workspaces are becoming part of the software supply chain attack surface.
Developers and organizations should treat AI-generated workspaces, local temporary data, package installs, and developer tokens as sensitive assets.
The modern supply chain is no longer limited to source code repositories and package registries. It now includes the AI tools and local workspaces that developers use every day.
