The AI Backdoor Nobody Saw Coming: How a Fake npm Package Raided Claude's File System
A malicious package disguised as a utility quietly exfiltrated files from Anthropic's Claude AI workspace directory — and GitHub was the getaway car.
Written by OutOfToken AI
June 6, 2026 · 4 min read · Synthesized from reporting by The Hacker News · How this works
Buried inside a deceptively named npm package, researchers at OX Security found something alarming: a fully operational data-theft routine pointed squarely at the internal file directory of Anthropic's Claude AI environment. The package, published under the name 'mouse5212-super-formatter,' managed to rack up 676 downloads before anyone flagged it as malicious. It wasn't targeting banks or government infrastructure — it was targeting the quiet, unguarded corner of a developer's machine where an AI assistant stores its working files.
The Anatomy of a Targeted Attack
What sets this incident apart from garden-variety npm malware is its surgical specificity. Rather than casting a wide net across common system directories, 'mouse5212-super-formatter' homed in on '/mnt/user-data' — the dedicated path that Claude uses to manage uploads and outputs during active sessions. This isn't a generic filepath that would appear on most Linux systems by default; it suggests the attacker had prior knowledge of how Claude structures its local environment. Once planted and executed, the package silently harvested files from that directory and exfiltrated them by uploading the stolen content to GitHub repositories — a technique that exploits the platform's trusted reputation to evade network-level detection tools that might otherwise flag traffic to unknown endpoints.
GitHub as an Exfiltration Channel
Using GitHub as a data exfiltration pipeline is a tactic that has grown in sophistication over recent years. Corporate firewalls and security appliances routinely whitelist traffic to GitHub's APIs, making it an attractive conduit for attackers who want to move stolen data without triggering alerts. In this case, the malware appears to have leveraged GitHub's API or repository push mechanisms to transfer Claude workspace files to attacker-controlled repos. The implication is chilling: sensitive documents, API keys, conversation outputs, or proprietary files that a developer had fed into Claude could have been quietly siphoned out with no visible warning to the user.
"'mouse5212-super-formatter' was downloaded 676 times before detection — each install a potential breach of an AI-assisted developer's most sensitive working files."
AI Tooling Expands the Attack Surface
This incident is a bellwether for a broader and underappreciated risk: as AI-native development tools embed themselves deeper into developer workflows, they introduce new, poorly understood attack surfaces. Claude, like other AI assistants designed for desktop or IDE integration, operates with filesystem access that many developers grant without scrutinizing the implications. Malicious packages that understand this architecture can leverage it to reach data that was never intended to be exposed to third-party code. OX Security's discovery underscores that threat actors are already mapping these new surfaces — the days of AI tooling being considered low-priority from a security standpoint are over. Supply chain attacks have always been opportunistic; now they're becoming AI-aware.
The 'mouse5212-super-formatter' incident will likely not be the last time attackers weaponize knowledge of AI tool internals against unsuspecting developers. As Anthropic, OpenAI, and others continue expanding the local and cloud-integrated footprints of their AI platforms, security teams need to treat AI working directories with the same rigor applied to credential stores and source code repositories. npm's open registry model — powerful, fast, and fundamentally trust-dependent — remains a persistent liability. Until package verification becomes the norm rather than the exception, every 'super-formatter' is a potential trojan horse waiting for its 677th victim.
Editorial Note
npm malware incidents are well-documented and plausible; however, the specific claim about a package targeting Claude's internal directory structure requires verification from Anthropic or OX Security's official documentation. The Hacker News is a reputable cybersecurity news source, but the specific technical details about the target path and Claude's architecture should be cross-referenced with official security advisories.
Claim Tracker
AI-assessed
No independent verification of OX Security's research provided; article cites only one source
Specific number lacks corroborating evidence or npm registry confirmation
Technical claim about Anthropic's Claude architecture lacks official confirmation from Anthropic
Incomplete sentence in source text; claim lacks supporting technical details or evidence
Speculative inference presented as fact; alternative explanations (reconnaissance, common directory patterns) not considered
Ask AI about this story
// discussion
sign in to join the discussion