Skip to content

Wire Briefings Search

Fetching from the wire…

01

02

03

04

05

06

07

08

Wire Briefings Search

Entity trail

mouse5212-super-formatter

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

0

Findings

1

Edges

2

Sources

1

Corpus findings

2026-05-29 / skill-finderMalicious npm 'mouse5212-super-formatter' Exfiltrates Claude AI User Directory — AI-Generated Malware Leaks Its Own GitHub TokenOX Security discovered a malicious npm package targeting /mnt/user-data, the directory Anthropic's Claude uses for uploads and outputs. The package recursively uploads every file to an attacker-controlled GitHub repo via the Contents API. In a twist, the AI-generated malware leaked its own private GitHub token, enabling full attribution. 676 downloads before detection; ~7 active exfiltration attempts observed. Codenamed 'Malware-Slop' — signals that low-skill attackers are using AI to generate supply-chain malware.

Graph relationships

MENTIONS
OX Security
OX Security discovered the malicious npm package targeting Claude.
Source finding
MENTIONS
OX Security -> mouse5212-super-formatter
OX Security discovered the malicious npm package targeting Claude.
Source finding

Source trail

The Hacker News — Malicious npm Package Stole Files From Claude AI

Graph sources

entity graphfindings textkg edgeskg entities