Malware · 109 days ago
A package install can cross the boundary into Claude user data if that data is mounted on the same host or container. The break is the install step itself: a malicious npm dependency can see the mounted upload/output directory and use whatever GitHub token is in scope to move files out as part of a fake sync.
OX Security found the still-downloadable npm package `mouse5212-super-formatter` doing this against `/mnt/user-data`, the directory Anthropic’s Claude uses for uploads and outputs. The package has been downloaded 676 times, and it authenticates to GitHub during `postinstall`, using an environment token or a hard-coded fallback before uploading local files to a GitHub account controlled by the operator.
The forward risk is broader than Claude. Any AI tool or agent that mounts local documents into build hosts, developer workstations, CI runners, or containers gives a malicious dependency a place to steal those files during install, even if the app itself is not directly compromised.
2 sources covering this story
AI-Generated npm Malware Leaks Its Own GitHub Token
Sloppy AI-generated npm infostealer leaked its own GitHub token, exposing the operator
Malicious npm Package Stole Files From Claude AI User Directory via GitHub
Malicious npm package downloaded 676 times stole Claude AI files via GitHub uploads, increasing AI-driven malware risks.
Part of the PlainSec briefing for 2026-05-30