Listen to this Post
Introduction
A newly discovered malicious npm package has sent shockwaves through the cybersecurity community — not because of its sophistication, but due to a glaring operational security failure that allowed researchers to trace the attack back to its creator. The package, named mouse5212-super-formatter, masquerades as a harmless development utility while silently exfiltrating sensitive files from compromised systems. In an ironic twist, the malware included a hardcoded private GitHub token belonging to the attacker, giving OX Security researchers unprecedented visibility into active data theft sessions before the repository was taken down.
This incident highlights a troubling trend where threat actors increasingly rely on AI-generated code to build malware quickly, often neglecting fundamental security practices in the process. The “Malware-Slop” campaign serves as a wake-up call for developers and security teams to scrutinize every dependency before installation.
Learning Objectives
- Understand the technical mechanics of how the mouse5212-super-formatter malware operates, including its post‑installation triggers and GitHub API‑based exfiltration methods.
- Learn to detect and remove the malicious package using Linux/Windows commands and forensic analysis techniques.
- Implement supply‑chain security best practices, including pre‑install scanning, token hygiene, and AI‑code review protocols to defend against AI‑generated malware.
You Should Know
1. Malware Breakdown: How the Infostealer Works
The mouse5212-super-formatter package was designed to appear as a legitimate “archive deployment sync” tool that validates GitHub repositories and collects basic network diagnostics. In reality, it operates as a full‑featured infostealer that activates immediately upon installation via a `postinstall` script defined in the package’s package.json.
Step‑by‑step guide explaining what this does and how to use it:
- Installation Trigger — When a developer runs
npm install mouse5212-super-formatter, the `postinstall` script executes automatically. This script authenticates to GitHub using either an environment token or a hardcoded fallback token embedded directly in the malware’s code. -
Repository Setup — The malware checks for the existence of a specific remote GitHub repository. If it doesn’t exist, it creates one using the GitHub API, effectively setting up an exfiltration server under the attacker’s control.
-
Directory Scanning — The malware recursively scans the local directory path
/mnt/user-data, a directory commonly associated with file handling operations inside Anthropic Claude AI environments. This suggests the attacker specifically targeted AI developers and users of Claude AI. -
File Exfiltration — Every discovered file is encoded using base64 and uploaded via the GitHub Contents API. The stolen data is organized into uniquely generated folders for each execution, allowing the attacker to manage multiple victim datasets efficiently.
-
Obfuscation — To reduce suspicion, the malware generates fake diagnostic logs labeled as “network connections,” masking its true intent. Code comments and commit messages were intentionally generic, likely generated by AI to appear benign during casual inspection.
Detection Commands for Linux/macOS:
Check if the malicious package is installed globally npm ls -g --depth=0 | grep mouse5212-super-formatter Search for the package in your project's node_modules find . -name "mouse5212-super-formatter" -type d Examine recent npm install logs grep "mouse5212-super-formatter" ~/.npm/_logs/ Check the /mnt/user-data directory for unauthorized access ls -la /mnt/user-data/
Detection Commands for Windows (PowerShell):
Check globally installed npm packages npm ls -g --depth=0 | Select-String "mouse5212-super-formatter" Search for the package in node_modules Get-ChildItem -Path . -Filter "mouse5212-super-formatter" -Directory -Recurse Examine npm logs Get-Content "$env:USERPROFILE.npm_logs.log" | Select-String "mouse5212-super-formatter" Check for suspicious file access in user data directories Get-ChildItem -Path "C:\mnt\user-data\" -Recurse
Remediation:
Remove the malicious package npm uninstall -g mouse5212-super-formatter npm uninstall mouse5212-super-formatter Revoke all GitHub access tokens immediately Go to GitHub Settings → Developer settings → Personal access tokens → Delete all tokens Delete any lingering files in /mnt/user-data that you do not recognize rm -rf /mnt/user-data/ Only if you are certain no legitimate data remains
2. The Accidental Leak That Enabled Attribution
Perhaps the most ironic aspect of this attack is that the threat actor’s own operational failure led to its discovery. The malware contained a hardcoded private GitHub token within its source code, allowing OX Security researchers to trace activity directly to the attacker’s repository, where approximately seven active exfiltration events were observed. Most of these appear to have been test runs conducted by the threat actor prior to wider deployment.
Step‑by‑step guide explaining what this does and how to use it:
- Static Analysis — Researchers extracted the hardcoded GitHub token from the malware’s source code. This token was not obfuscated or encrypted, making it immediately visible.
-
Repository Forensics — Using the leaked token, researchers accessed the attacker’s GitHub account and repository, where they observed commit timestamps and activity logs. The GitHub account was created only hours before the first malicious version was uploaded to npm, and the attacker tested functionality in a repository labeled “test”.
-
Real‑Time Monitoring — The token enabled researchers to observe active data theft sessions in real time, providing a rare glimpse into the attacker’s operations.
-
Account Takedown — Shortly after discovery, the GitHub account was deleted, though the npm package remained accessible at the time of reporting.
Key Lessons for Security Teams:
- Never hardcode secrets in source code, especially in malware. Use environment variables or secure secret management solutions.
- Implement mandatory secret scanning in CI/CD pipelines to detect and block hardcoded credentials.
- Monitor for suspicious GitHub account activity, such as accounts created shortly before publishing packages.
Example of a Dangerous Hardcoded Token (for educational purposes):
// Example of what the leaked token looked like (format only)
const GITHUB_TOKEN = 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
// The malware used this to authenticate with GitHub
const authHeaders = {
'Authorization': <code>token ${GITHUB_TOKEN}</code>,
'Accept': 'application/vnd.github.v3+json'
};
3. AI‑Generated Malware and the Rise of “Malware‑Slop”
The “Malware‑Slop” campaign represents a broader shift in the threat landscape where attackers increasingly rely on AI‑generated code to build malware quickly. While this lowers the barrier to entry, it also introduces operational flaws, as seen in this case. Poor implementation of basic security practices, such as token handling and operational security (OPSEC), can expose attackers and provide defenders with valuable forensic insights.
Step‑by‑step guide explaining what this does and how to use it:
- AI‑Assisted Code Generation — The attacker likely used an AI coding assistant (possibly Anthropic’s Claude) to generate the malware’s source code. The generic comments and commit messages suggest AI involvement.
-
Low‑Effort Supply Chain Threats — The package reached 676 downloads before being reported, demonstrating how quickly low‑effort malware can spread. Attackers are exploiting developers’ trust in npm packages without implementing proper evasion techniques.
-
Defensive Strategies — Security teams must adapt to this new threat model by implementing:
– Static analysis for known malicious patterns and hardcoded secrets.
– Behavioral analysis to detect suspicious post‑install activities.
– Sandboxed execution for testing new packages before deployment.
Detection Tools to Protect Against Malware-Slop:
Install and use guard-install to scan packages before installation npx guard-install mouse5212-super-formatter Use slopcop to intercept the kill chain npm install -g slopcop slopcop install mouse5212-super-formatter Use pkg-sniffer-cli to flag suspicious dependencies npm install -g pkg-sniffer-cli pkg-sniffer scan package.json Use nymc to scan for known malware packages npm install -g @krisbyte/nymc nymc scan Use ssafe for pre-install detection npm install -g ssafe ssafe install mouse5212-super-formatter
4. Supply Chain Hardening for npm Ecosystems
The mouse5212-super-formatter incident underscores the importance of supply chain security. With the npm ecosystem hosting over two million packages, malicious packages can easily slip through traditional defenses. Developers and organizations must adopt a defense‑in‑depth approach.
Step‑by‑step guide explaining what this does and how to use it:
- Pre‑Install Scanning — Never install npm packages without first scanning them for known malicious patterns. Use tools like
guard-install,slopcop, or `pkg-sniffer-cli` to analyze packages before they touch your system. -
Lock File Auditing — Regularly audit your `package-lock.json` or `yarn.lock` files for suspicious dependencies. Use automated tools to compare installed packages against known threat intelligence feeds.
-
Least Privilege for Tokens — Ensure that GitHub tokens used in CI/CD pipelines have the minimum required permissions. Use fine‑grained personal access tokens (PATs) and rotate them frequently.
-
Runtime Monitoring — Implement runtime monitoring to detect anomalous behavior such as unexpected file access, outbound network connections, or API calls to unauthorized endpoints.
-
Incident Response — If a malicious package is detected, immediately revoke all compromised tokens, isolate affected systems, and conduct a forensic investigation to determine the scope of the breach.
Sample CI/CD Configuration to Block Malicious Packages:
.github/workflows/npm-security.yml
name: npm Security Scan
on: [push, pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install dependencies safely
run: |
npm install -g guard-install
guard-install --check-all
- name: Scan for known malware
run: |
npm install -g @krisbyte/nymc
nymc scan
- name: Check for hardcoded secrets
run: |
npm install -g secrets-scan
secrets-scan --pattern 'ghp_[a-zA-Z0-9]{36}'
5. Post‑Breach Forensics and Recovery
If your system has been compromised by the mouse5212-super-formatter package, immediate action is required to contain the damage and restore integrity.
Step‑by‑step guide explaining what this does and how to use it:
- Immediate Isolation — Disconnect the affected system from the network to prevent further data exfiltration.
-
Token Revocation — Revoke all GitHub access tokens, npm tokens, and any other credentials that may have been exposed. Use GitHub’s security log to review recent activity.
-
File Recovery — Check the `/mnt/user-data` directory for any files that may have been exfiltrated. Treat these files as compromised and assume they are in the hands of the attacker.
-
Log Analysis — Examine npm logs, system logs, and GitHub audit logs for signs of unauthorized access. Look for outbound API calls to GitHub’s Contents API or unusual network traffic.
-
System Reimaging — In severe cases, reimage the affected system to ensure no persistence mechanisms remain.
Forensic Commands:
Check system logs for npm install events
journalctl | grep "npm install"
On Windows, check event logs for PowerShell execution
Get-WinEvent -LogName "Windows PowerShell" | Where-Object {$_.Message -like "mouse5212-super-formatter"}
Search for base64-encoded data in network logs
grep -r "base64" /var/log/
Monitor outgoing connections to GitHub API
sudo tcpdump -i eth0 host api.github.com and port 443
What Undercode Say
- AI lowers the bar for attackers but doesn’t replace OPSEC fundamentals. The mouse5212-super-formatter case proves that even with AI‑generated code, a single hardcoded token can unravel an entire campaign. Attackers trading speed for security will continue to make mistakes that defenders can exploit.
-
Supply chain attacks are becoming the primary vector for initial compromise. With 676 downloads before takedown, this incident shows how quickly a malicious package can spread through the npm ecosystem. Developers must treat every dependency as a potential threat and implement pre‑install scanning as a mandatory step.
The broader lesson here is that the security community must evolve its defenses to keep pace with AI‑assisted attacks. Traditional signature‑based detection is no longer sufficient when attackers can generate novel malware on demand. Behavioral analysis, sandboxed execution, and real‑time threat intelligence sharing will become essential components of any robust security program. Organizations should also invest in developer education, teaching teams to recognize suspicious package names, scrutinize post‑install scripts, and never install packages from untrusted sources without thorough vetting.
Prediction
The “Malware‑Slop” campaign foreshadows a future where AI‑generated malware becomes the norm, flooding package registries with low‑quality but still dangerous code. As AI coding assistants become more accessible, the volume of malicious packages is likely to increase exponentially, overwhelming traditional security tools and manual review processes. We can expect to see more attackers making basic OPSEC mistakes in the short term, but as AI models improve, they will begin to incorporate better evasion techniques and automated secret handling. The window of opportunity for defenders is now: implement behavioral detection, enforce strict token hygiene, and adopt a zero‑trust approach to all third‑party dependencies before the next wave of AI‑polished malware arrives.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mayura Kathiresh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
