A package install can cross the boundary into Claude user data if that data is mounted on the same host or container. The break is the install step itself: a malicious npm dependency can see the mounted upload/output directory and use whatever GitHub token is in scope to move files out as part of a fake sync.
OX Security found the still-downloadable npm package `mouse5212-super-formatter` doing this against `/mnt/user-data`, the directory Anthropic’s Claude uses for uploads and outputs. The package has been downloaded 676 times, and it authenticates to GitHub during `postinstall`, using an environment token or a hard-coded fallback before uploading local files to a GitHub account controlled by the operator.
The forward risk is broader than Claude. Any AI tool or agent that mounts local documents into build hosts, developer workstations, CI runners, or containers gives a malicious dependency a place to steal those files during install, even if the app itself is not directly compromised.