AI Risk Wire

Cases › security breach › LR-2026-0552

AI-generated npm malware targets Claude user files and leaks its GitHub token

Confirmed Why: 2 independent outlets · 2 independent reports

Status: no action reported

Severity moderate
Reported 27 May 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity moderate: test: data of others touched (files from user directories and a GitHub token) with a bounded scope stated as an estimated 676 downloads; the source notes the install count is unclear.

Cybersecurity researchers reported a malicious npm package named mouse5212-super-formatter. According to OX Security, the package was designed to upload files from a directory used by Anthropic's Claude tool. The script presented itself as an internal archive utility, but during the postinstall stage it authenticated to GitHub using a token found in the victim's environment or a hard-coded fallback token, then recursively uploaded every file to a threat actor-controlled GitHub account. The package was still available on npm and was estimated to have been downloaded 676 times, though how many correspond to actual installs remains unclear. The GitHub account linked to the campaign is no longer available. The package also leaked details of that account, including its private token.

What happened

1 · What it was doingA npm package named mouse5212-super-formatter was designed to upload files from a directory used by Anthropic's Claude tool.
2 · What went wrongDuring postinstall it authenticated to GitHub with a token from the victim's environment or a hard-coded fallback, then uploaded every file to a threat actor-controlled account.
3 · What it reached or didThe package was estimated to have been downloaded 676 times, though how many were actual installs remains unclear.
4 · How it was caughtCybersecurity researchers discovered the malicious package on the npm registry.

What was done

No source states an action or fix.

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week
Data leaked or sent out
Also32 incidents
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

  1. May 26, 2026 The GitHub account linked to the campaign was created.

Not dated in the sources:

  • Researchers discovered the malicious package on the npm registry.
  • The package remained available for download from npm.
  • The GitHub account linked to the campaign is no longer available.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-05-27
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
C one secondary source states it
Who was responsible
an outside party
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK06
D inferred by us from the described behaviour, reason shown
secondary risks
RK04, RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy, others' security
C one secondary source states it
Why this severity
test: data of others touched (files from user directories and a GitHub token) with a bounded scope stated as an estimated 676 downloads; the source notes the install count is unclear.
D inferred by us from the described behaviour, reason shown

Notes on gaps

The 676 figure is estimated downloads, not confirmed installs or affected parties. The leaked token belonged to the threat actor's account, not to Anthropic or the victim, and no remediation was reported. Controls and remediations beyond these are not stated in the sources.

LR-2026-0552 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON