"Malware-Slop": Malicious npm Package Caught Stealing Files From Claude AI's User Directory via GitHub

Cybersecurity researchers at OX Security have uncovered a malicious package on the npm registry that specifically targets files stored in Anthropic's Claude AI tool directory. The campaign, dubbed Malware-Slop, centers around a package named mouse5212-super-formatter and represents a growing trend of AI-focused supply chain attacks carried out with low operational sophistication, but real consequences.

What the Package Does

On the surface, the package presents itself as an internal "archive deployment sync" utility, claiming to validate GitHub repositories and send network diagnostic information. In reality, it is a data theft tool with a very specific target: the /mnt/user-data directory, the dedicated folder that Claude AI uses to handle file uploads and outputs in the background.

The malicious behavior is triggered during the postinstall stage, meaning it executes automatically the moment a developer installs the package. At that point, the malware authenticates to GitHub using either a token found in the victim's environment variables or a hard-coded fallback token built into the package itself. It then checks whether a target repository already exists on an attacker-controlled GitHub account, creates one if it doesn't, and proceeds to recursively upload every file it can find in the Claude AI user directory to that remote repository.

To disguise its true purpose, the package writes a fake "network connections" log to give the impression it is only sending diagnostic information, while silently exfiltrating local data in the background. Stolen files are organized into randomly named folders on the attacker's GitHub account, allowing the operator to distinguish between different victims and theft sessions.

Scale and Current Status

The package has been downloaded approximately 676 times, though how many of those represent actual installations with real data exposure remains unclear. The attacker's GitHub account, which received all the stolen files was created on May 26, 2026, just hours before the first malicious version of the package was uploaded to npm. The GitHub account is no longer accessible, though the npm package itself remains available for download at the time of reporting.

A Sloppy Attacker Who Left the Door Open

One of the most notable aspects of this campaign is what it reveals about the attacker's operational security or lack thereof. The package inadvertently leaked the GitHub account's own private token in its code, effectively exposing the attacker's infrastructure to anyone who looked closely enough. This careless error points strongly toward the use of AI-generated malware, where the threat actor appears to have used an AI tool to write the malicious code without fully understanding or reviewing what was produced.

OX Security noted this as a defining characteristic of the emerging "Malware-Slop" threat category malware that is sloppy, poorly secured, and often mimics the style of more sophisticated APT campaigns without the tradecraft. As the barrier to creating functional malicious code continues to drop thanks to AI coding tools, security researchers expect a surge in this type of low-effort but potentially damaging supply chain attack.

What Developers Should Do

Anyone who has installed mouse5212-super-formatter should treat the Claude AI user directory contents as potentially compromised and rotate any credentials or tokens that may have been stored or processed there. Security teams should audit npm dependencies for recently added or unfamiliar packages and consider tools that monitor for suspicious postinstall script behavior.

Resources