Malware Dev Tries to Steal Claude Users' Secrets, Writes Npm Slop, Leaks Own GitHub Private Token

Malware dev tries to steal Claude users' secrets, writes npm slop, leaks own GitHub private token

An npm-slop package “mouse5212-super-formatter” targeting Claude users and acting as a stealer reached 676 downloads before being removed from the registry - and after making a major vibe coding blunder. The AI-generated malware leaked its own GitHub private token, thus allowing OX Security researchers to trace the stolen files and analyze the malware before issuing this warning: “We’re going to see more threat actors getting into the game – upl…

AI-Generated npm Malware Accidentally Exposes Threat Actor’s Private GitHub Token

A new wave of AI-generated malware is hitting the open-source software ecosystem, and this time, the attacker made a critical mistake that gave researchers a rare inside look at their operation. A malicious package named “mouse5212-super-formatter” was discovered on the npm registry, acting as an infostealer designed to quietly steal files from any developer who installed it. What made this case unusual was not just what the malware did, but wha…

A malware dev has committed a magnificent self-own after an AI-coded malicious package leaked its own GitHub private token

Whoops.

Malicious npm Package Stole Files From Claude AI User Directory via GitHub

Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities. According to OX Security, the package, named "mouse5212-super-formatter," is designed to upload files from "/mnt/user-data," a dedicated directory used by Anthropic's Claude artificial intelligence (AI) tool to handle uploads and outputs in the background. The