The malicious npm package mouse5212-super-formatter is another reminder that developer environments and AI workspaces are now active targets in supply-chain attacks. According to the report, the package was designed to steal files from /mnt/user-data, a directory used by Anthropic’s Claude AI tool for uploads and outputs, and then upload those files to an attacker-controlled GitHub account.

This is especially concerning because AI-assisted development environments may contain prompts, source files, configuration data, API outputs, working documents, credentials, and other sensitive project material. The malware executed during the npm postinstall stage, authenticated to GitHub using either a victim environment token or a hard-coded fallback token, created a repository if needed, and recursively uploaded local files into randomly named folders. Naturally, even “formatter” packages now need a criminal background check, because the software supply chain has become ridiculous. 

The package reportedly had around 676 downloads, though actual successful installations are unclear. The campaign has been called Malware-Slop, partly because the package leaked details of the attacker’s GitHub account and token, suggesting low-quality or AI-assisted malware development with poor operational security. But sloppy malware can still steal real data, which is the annoying part criminals keep relying on. 

Organizations should review npm dependencies, block or remove mouse5212-super-formatter, inspect build and developer systems for suspicious postinstall activity, check for unauthorized GitHub uploads, and rotate any exposed GitHub tokens, npm tokens, API keys, cloud credentials, and secrets that may have been accessible from affected workspaces. 

The broader lesson is simple: npm packages, AI workspaces, developer machines, and local project directories are all part of the modern attack surface. Teams should restrict install scripts where possible, use dependency scanning, review new packages before installation, isolate secrets from developer environments, and monitor outbound traffic from build machines. A package that claims to format code should not be exfiltrating your workspace to GitHub. That feels like a low bar, yet here we are.

Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities. According to OX Security, the package, named "mouse5212-super-formatter," is designed to upload files from "/mnt/user-data," a dedicated directory used by Anthropic's Claude artificial intelligence (AI) tool to handle uploads and outputs in the background. The

Source: Malicious npm Package Stole Files From Claude AI User Directory via GitHub via The Hacker News — published 27 May 2026.