Malicious npm package targets Claude AI user data directory

Affected Systems

npm package "mouse5212-super-formatter" (all versions). Targets developers using Anthropic Claude AI tools with access to /mnt/user-data directory. Affects Node.js development environments where the malicious package was installed.

Exploitation Status

Active supply chain attack. Malicious package was published to npm registry and discovered by OX Security. Package designed to exfiltrate files from Claude AI user data directory (/mnt/user-data). No CVE assigned.

Business Impact

Developers who installed the malicious package risk exposure of sensitive data stored in Claude AI's user data directory, potentially including API keys, conversation history, project files, and credentials. Supply chain compromise could lead to intellectual property theft and credential harvesting. Organizations using Claude AI in development workflows face data exfiltration risk.

Urgency

🔴 Immediate

Recommended Actions

• Immediately search all Node.js projects for 'mouse5212-super-formatter' in package.json and package-lock.json files and remove if present
• Audit npm install logs and package manager history for evidence of the malicious package installation
• Inspect /mnt/user-data directory on systems running Claude AI tools for unauthorized access or file modifications
• Rotate API keys, tokens, and credentials that may have been stored in Claude AI user data directories
• Implement npm package verification controls such as Socket Security or Snyk to detect malicious packages before installation