Malicious npm Package Stole Files From Claude AI User Directory via GitHub

A malicious npm package "mouse5212-super-formatter" steals files from Claude AI's /mnt/user-data directory and uploads them to attacker GitHub accounts.

• •Masquerades as an "archive deployment sync" utility during installation
• •Authenticates to GitHub using stolen or hard-coded tokens
• •Hides behavior with fake network diagnostic logs
• •Downloaded approximately 676 times before discovery
• •Threat actor used AI to generate malware but failed basic operational security practices

This summary was automatically generated by AI based on the original article and may not be fully accurate.