THREAT INTELLIGENCE REPORT

Malware-Slop: Malicious npm Package Stealing Claude AI User Data Through GitHub Exfiltration

Analysis of the Malware-Slop campaign involving a malicious npm package that targeted Anthropic Claude AI user directories, harvested local files, abused GitHub repositories for exfiltration, and leveraged deceptive package behavior to evade detection.

Threat Type
Supply Chain Attack
Package
mouse5212-super-formatter
Target
Claude AI Users
Report Date
May 2026

Executive Summary

Researchers discovered a malicious npm package named mouse5212-super-formatter that masqueraded as a formatting utility while secretly stealing files from environments using Anthropic Claude AI. The malware specifically targeted the /mnt/user-data directory used by Claude to manage uploaded and generated files.

The package abused npm lifecycle hooks to automatically execute malicious code after installation, authenticate to GitHub using available credentials, create attacker-controlled repositories, and exfiltrate victim files. Researchers named the campaign Malware-Slop.

Critical Finding: The malware specifically targeted AI workflow data, demonstrating a growing trend of attackers targeting AI development environments and sensitive AI-generated content.

Threat Overview Metrics

Threat Level

High

Downloads

676+

Target Platform

npm

Victim Data

Claude Files

Exfiltration

GitHub

Attack Vector

Postinstall Hook

Threat Profile

Attribute Details
Campaign Name Malware-Slop
Malicious Package mouse5212-super-formatter
Repository npm Registry
Primary Target Claude AI User Directory
Exfiltration Channel GitHub Repository
Discovery Source OX Security

Attack Timeline

Package Upload

Threat actor publishes malicious npm package disguised as a formatter utility.

User Installation

Victim installs package through npm dependency workflow.

Postinstall Execution

Malicious code executes automatically during installation.

GitHub Authentication

Package searches for GitHub tokens or uses hardcoded credentials.

Data Exfiltration

Files from Claude AI directories are uploaded to attacker-controlled repositories.

Technical Analysis

Targeted Directory

The malware specifically searched for files stored in the Claude AI workspace located at /mnt/user-data. This directory commonly contains uploaded files, generated outputs, analysis results, and temporary working data.

GitHub Abuse

Instead of using traditional command-and-control infrastructure, the malware leveraged GitHub repositories as a covert exfiltration channel. Files were uploaded into randomly generated folders to separate victim sessions.

Deception Techniques

The malware generated fake network diagnostic logs to disguise its real activity and make investigators believe the package only performed connectivity testing.

Detection Challenge: The use of legitimate GitHub services allows data exfiltration traffic to blend with normal developer activity and bypass many traditional network monitoring controls.

Attack Flow

Stage Description
Installation npm package installation
Execution Postinstall hook triggers malware
Credential Discovery Searches environment for GitHub token
Repository Creation Creates attacker-controlled repository
File Collection Harvests files from Claude workspace
Exfiltration Uploads files to GitHub

Indicators of Compromise (IOCs)

Type Indicator
Package Name mouse5212-super-formatter
Target Directory /mnt/user-data
Registry npm
Exfiltration Method GitHub Repository Upload
Execution Method Postinstall Hook
Campaign Malware-Slop
Immediate Response: Organizations should identify installations of the package, review GitHub access logs, rotate exposed GitHub tokens, and assess whether sensitive Claude AI data was accessed or exfiltrated.

MITRE ATT&CK Mapping

Tactic Technique ID
Initial Access Supply Chain Compromise T1195
Execution User Execution T1204
Collection Data from Local System T1005
Credential Access Credentials from Environment Variables T1552.001
Exfiltration Exfiltration Over Web Services T1567
Defense Evasion Masquerading T1036

Mitigation Recommendations

  1. Remove the malicious package immediately.
  2. Audit npm dependencies regularly.
  3. Rotate exposed GitHub tokens.
  4. Monitor GitHub repository creation activity.
  5. Restrict outbound repository access where possible.
  6. Scan environments for suspicious npm lifecycle hooks.
  7. Implement software composition analysis tools.
  8. Monitor AI-related storage directories for unauthorized access.
Best Practice: Implement dependency security scanning, token management controls, and monitoring for unusual interactions with AI-related directories and cloud repositories.

References