{"schema_version":"0.10.0","id":"LR-2026-0552","record_version":1,"title":"AI-generated npm malware targets Claude user files and leaks its GitHub token","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"9377789c10d8de59f59b30e27be9ed3ce23cd935537ace4843643efa0d783a31"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-27","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Cybersecurity researchers reported a malicious npm package named mouse5212-super-formatter. According to OX Security, the package was designed to upload files from a directory used by Anthropic's Claude tool. The script presented itself as an internal archive utility, but during the postinstall stage it authenticated to GitHub using a token found in the victim's environment or a hard-coded fallback token, then recursively uploaded every file to a threat actor-controlled GitHub account. The package was still available on npm and was estimated to have been downloaded 676 times, though how many correspond to actual installs remains unclear. The GitHub account linked to the campaign is no longer available. The package also leaked details of that account, including its private token.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK06","secondary_risks":["RK04","RK03"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test: data of others touched (files from user directories and a GitHub token) with a bounded scope stated as an estimated 676 downloads; the source notes the install count is unclear.","harm_class":["privacy","third_party_security"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html","publisher":"The Hacker News","date":"2026-05-27","type":"press","title":"Malicious npm Package Stole Files From Claude AI User Directory via GitHub - The Hacker News","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://www.theregister.com/cyber-crime/2026/05/27/supply-chain-brain-drain-npm-attacker-foolishly-leaks-own-github-private-token/5247424","publisher":"The Register","date":"2026-05-27","type":"press","title":"Malware dev tries to steal Claude users' secrets, writes npm slop, leaks own GitHub private token - The Register","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","event.responsible_party":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities."}],"event.detection_method":[{"source_index":0,"quote":"Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities."}],"event.responsible_party":[{"source_index":0,"quote":"In reality, however, it authenticates to GitHub during the postinstall stage, either using a GitHub access token found in the victim's environment or a hard-coded token as a fallback, checks whether a target repository exists, and if not, creates it, and then recursively uploads every file to a threat actor-controlled GitHub account."}],"impact.harm_class":[{"source_index":0,"quote":"According to OX Security, the package, named \"mouse5212-super-formatter,\" is designed to upload files from \"/mnt/user-data,\" a dedicated directory used by Anthropic's Claude artificial intelligence (AI) tool to handle uploads and outputs in the background."}],"impact.severity":[{"source_index":0,"quote":"The package is still available for download from npm and is estimated to have been downloaded 676 times."}],"impact.severity_because":[{"source_index":0,"quote":"The package is still available for download from npm and is estimated to have been downloaded 676 times."}],"event.summary":[{"source_index":0,"quote":"According to OX Security, the package, named \"mouse5212-super-formatter,\" is designed to upload files from \"/mnt/user-data,\" a dedicated directory used by Anthropic's Claude artificial intelligence (AI) tool to handle uploads and outputs in the background."},{"source_index":0,"quote":"In reality, however, it authenticates to GitHub during the postinstall stage, either using a GitHub access token found in the victim's environment or a hard-coded token as a fallback, checks whether a target repository exists, and if not, creates it, and then recursively uploads every file to a threat actor-controlled GitHub account."},{"source_index":0,"quote":"The package is still available for download from npm and is estimated to have been downloaded 676 times."},{"source_index":0,"quote":"However, how many of these correspond to actual installs remains unclear."},{"source_index":0,"quote":"The GitHub account linked to the campaign is no longer available, although OX noted that it was created on May 26, 2026, a few hours before the first malicious version was uploaded to npm."},{"source_index":0,"quote":"What's notable about the package is that it leaked details of the GitHub account, including its private token, raising the possibility that the threat actor is using AI to generate malware while not implementing basic operational security (OPSEC) best practices."}]},"notes_on_gaps":"Source 0 is the only relevant source; source 1 is a site navigation list with no content about this incident and was not used. The source body gives no publication date, so date_disclosed and the source date are omitted; the 2026-05-27 header date is not written as a value. No AI agent or autonomous system is described as acting in the incident (the AI origin of the malware is only a possibility the source raises), so agent_involved, failure_class and related agent fields are omitted. The trigger, root cause, adversarial actor, date of occurrence, duration, containment time and affected-party count are not stated and are left out. The 676 figure is estimated downloads, not confirmed installs or affected parties. The severity tier moderate is my judgement from the data of others touched and the bounded estimate stated. The G3 outcome 'missing' is my inference from the source's statement that npm does not yet automatically block such malware. The leaked token belonged to the threat actor's account, not to Anthropic or the victim, and no remediation was reported. Controls and remediations beyond these are not stated in the sources. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"A npm package named mouse5212-super-formatter was designed to upload files from a directory used by Anthropic's Claude tool.","quote":"According to OX Security, the package, named \"mouse5212-super-formatter,\" is designed to upload files from \"/mnt/user-data,\" a dedicated directory used by Anthropic's Claude artificial intelligence (AI) tool to handle uploads and outputs in the background.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"During postinstall it authenticated to GitHub with a token from the victim's environment or a hard-coded fallback, then uploaded every file to a threat actor-controlled account.","quote":"In reality, however, it authenticates to GitHub during the postinstall stage, either using a GitHub access token found in the victim's environment or a hard-coded token as a fallback, checks whether a target repository exists, and if not, creates it, and then recursively uploads every file to a threat actor-controlled GitHub account.","source_index":0,"grade":"C"},{"step":"reached","text":"The package was estimated to have been downloaded 676 times, though how many were actual installs remains unclear.","quote":"The package is still available for download from npm and is estimated to have been downloaded 676 times.","source_index":0,"grade":"C"},{"step":"caught","text":"Cybersecurity researchers discovered the malicious package on the npm registry.","quote":"Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html","https://www.theregister.com/cyber-crime/2026/05/27/supply-chain-brain-drain-npm-attacker-foolishly-leaks-own-github-private-token/5247424"]},"analysis":{"sections":{"timeline":[{"text":"Researchers discovered the malicious package on the npm registry.","quote":"Cybersecurity researchers have discovered a new malicious package on the npm registry that comes with information stealing capabilities.","source_index":0,"when":null},{"text":"The GitHub account linked to the campaign was created.","quote":"The GitHub account linked to the campaign is no longer available, although OX noted that it was created on May 26, 2026, a few hours before the first malicious version was uploaded to npm.","source_index":0,"when":"May 26, 2026"},{"text":"The package remained available for download from npm.","quote":"The package is still available for download from npm and is estimated to have been downloaded 676 times.","source_index":0,"when":null},{"text":"The GitHub account linked to the campaign is no longer available.","quote":"The GitHub account linked to the campaign is no longer available, although OX noted that it was created on May 26, 2026, a few hours before the first malicious version was uploaded to npm.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://thehackernews.com/2026/05/malicious-npm-package-stole-files-from.html","https://www.theregister.com/cyber-crime/2026/05/27/supply-chain-brain-drain-npm-attacker-foolishly-leaks-own-github-private-token/5247424"]}}