# Malicious npm Package Exploited Claude AI Users in Fresh Supply Chain Attack—Researchers Warn of AI-Lowered Barriers to Malware Creation
A newly discovered malicious npm package has exposed a critical vulnerability in the software supply chain, targeting users of Anthropic's Claude AI platform through a sophisticated file-stealing scheme. Security researchers at OX Security identified the package, named mouse5212-super-formatter, which was designed to exfiltrate sensitive files from Claude's dedicated workspace directory and upload them to a threat actor-controlled GitHub account.
## The Threat
The malicious package, downloaded approximately 676 times from npm's public registry, employed a deceptive post-install routine that presented itself as a legitimate utility for archive deployment and synchronization. In reality, it performed unauthorized reconnaissance and data theft, stealing files from /mnt/user-data—a directory specifically used by Anthropic's Claude AI tool to manage user uploads and outputs during background processing.
The campaign, which researchers have codenamed Malware-Slop, demonstrates a troubling trend: attackers are increasingly using AI-assisted code generation to rapidly prototype malware with minimal regard for operational security practices. The threat actor behind this operation made critical mistakes that exposed their infrastructure, including the hardcoded GitHub personal access token embedded in the malware itself.
## Background and Context
### Supply Chain Attacks on the Rise
The discovery of mouse5212-super-formatter represents the latest in a growing wave of supply chain attacks targeting open-source ecosystems. Unlike traditional malware that relies on social engineering to trick users into downloading suspicious files, supply chain attacks leverage the trust developers place in third-party packages—fundamentally poisoning the development pipeline.
npm, the world's largest software package registry, has been a recurring target. Previous notable incidents include:
The discovery of mouse5212-super-formatter underscores how attackers continue to exploit the implicit trust developers place in the npm ecosystem, where packages are often installed with minimal verification.
### The Claude AI Angle
Claude AI has become increasingly popular among developers, researchers, and enterprises for code generation, analysis, and general-purpose AI tasks. The /mnt/user-data directory targeted by this malware is a key component of Claude's architecture—it's where user-provided files, project artifacts, and potentially sensitive documents are temporarily stored during AI processing sessions.
By specifically targeting this directory, the threat actor demonstrated knowledge of Claude's operational infrastructure, suggesting either reconnaissance prior to package creation or familiarity with published documentation about how the service handles file uploads.
## Technical Details
### How the Malware Operated
According to researchers Moshe Siman Tov Bustan and Nir Zadok, the malicious package employed a multi-stage attack chain:
Stage 1: Deceptive Installation
The package masqueraded as an internal utility called "archive deployment sync," claiming to validate or initialize GitHub repositories. This social engineering tactic was designed to appear legitimate in development workflows.
Stage 2: GitHub Authentication
During the post-install phase, the malware authenticated to GitHub using one of two methods:
Stage 3: Repository Preparation
The malware checked whether a target GitHub repository under the threat actor's account already existed. If not, it automatically created one, demonstrating full automation of the attack chain.
Stage 4: Recursive File Exfiltration
The malware recursively scanned and uploaded every accessible file from /mnt/user-data and surrounding directories to the attacker-controlled GitHub repository. Files were organized into randomly named folders to help the operator distinguish between different compromise sessions and avoid detection.
Stage 5: Obfuscation
To further hide its activities, the malware wrote fake "network connections" logs, creating the appearance of diagnostic telemetry while concealing the true nature of its data exfiltration operations.
## The Malware-Slop Campaign and Operational Failures
### AI-Generated Code, Human-Level Mistakes
The analysis of mouse5212-super-formatter reveals a critical paradox: while the malware was sophisticated enough to target a specific AI platform and implement multi-stage exfiltration, the threat actor made fundamental operational security errors that exposed their entire operation.
The smoking gun: A GitHub personal access token was hardcoded directly into the malware's source code. This token, discoverable through static analysis, allowed researchers to:
This type of error is consistent with code generated by large language models without human review and hardening. It suggests the threat actor prioritized speed of development over security practices—a pattern that OX Security researchers predict will become increasingly common as AI lowers the barrier to entry for cybercriminals.
### Package Availability and Detection Timeline
Despite being flagged by researchers, the package remained available on npm's public registry at the time of publication, though with an unknown number of actual installations versus downloads. The delay in removal highlights a longstanding tension in open-source security: balancing rapid response times against the need for investigation and verification.
## Implications for Organizations
### Immediate Risk Assessment
Organizations using Claude AI for sensitive work face a direct risk from this campaign. If employees installed the mouse5212-super-formatter package in their development environments, their Claude workspace files may have been exfiltrated. This could include:
### Broader Software Supply Chain Vulnerability
This incident reinforces a fundamental weakness in how the software industry manages open-source dependencies. Developers typically install packages with implicit trust, running arbitrary code with the same permissions as their development environment. The attack surface is massive: npm alone hosts over 3 million packages.
### The AI-Malware Barrier Question
Researchers at OX Security noted a concerning trend: "Now that the bar to create malicious code was reduced significantly, we're going to see more threat actors getting into the game—uploading more sloppy malwares, mostly mimicking APT groups to get a slice of the cake."
This suggests we may be entering an era of quantity-over-quality attacks, where volume and speed outweigh sophistication, potentially overwhelming security teams' detection and response capabilities.
## Recommendations
### For Individual Developers
.env filesnpm audit and consider npm's built-in verification features before installing packages### For Organizations
### For npm and Package Registries
---
## HackWire Analysis
The discovery of mouse5212-super-formatter represents a watershed moment in open-source security, but not for the reasons most reporters will emphasize.
Yes, it's another npm supply chain attack. Yes, it targeted Claude AI users. But the truly significant detail is the operational incompetence masked by technical sophistication. This malware was built with AI assistance—probably Claude itself—yet it embedded a working GitHub token in plain sight. That's not sophisticated; that's a red flag about the near-future landscape of cyber attacks.
The real story is the *democratization of malware development*. When LLMs can generate functional malware in minutes, the security industry loses its historical advantage: the assumption that serious attacks come from well-resourced, careful adversaries. Instead, we're entering an era where script kiddies with access to Claude or similar tools can generate malware that works 60-70% as well as hand-crafted code, at a fraction of the cost and time.
For defenders, this means three things:
1. Volume is the new sophistication: Expect more attacks, lower quality each, but sheer numbers will overwhelm legacy detection.
2. Speed matters more than stealth: The mouse5212 campaign leaked its own GitHub token—but by then, 676 people had already downloaded it. Speed won.
3. The supply chain is the weakest link: Every package installed is a post-install execution environment. No amount of endpoint security fixes that.
Organizations shouldn't focus on "what Claude users need to do"—they should focus on why their development pipelines allow arbitrary code execution from random npm maintainers. That's the real vulnerability.
— *HackWire Editorial*
---
## Related Coverage