The npm Package That Reached Into Claude's Sandbox
A bait package called mouse5212-super-formatter quietly siphoned files from the directory Anthropic's Claude uses to handle user uploads, exfiltrating them to a GitHub repo controlled by the author.
The package landed on the npm registry looking like nothing in particular. A formatter. One of thousands. The kind of utility a developer installs at 11 p.m. without reading the README, the kind that lives forever in a node_modules folder no one audits.
Its name was mouse5212-super-formatter. And what it actually did, according to researchers at OX Security, was crawl into /mnt/user-data — the working directory Anthropic's Claude assigns inside its code-execution sandbox to hold user uploads and generated outputs — and quietly hand the contents off to a GitHub repository controlled by the package author.
That detail is what makes this one strange. Most npm stealers reach for the usual prizes: SSH keys, npm tokens, browser cookies, the .env file sitting next to the project. This one was tuned for an AI assistant's scratch space. Whoever wrote it knew exactly where Claude keeps the files a user has dragged into a conversation.
The mechanics were unsubtle. On install, the package walked the user-data directory, packaged what it found, and pushed it to a remote repo using credentials baked into the script. No obfuscation worth mentioning. No staged loader. Just a smash-and-grab against a folder most developers don't think of as a folder at all — it's the bit of Claude they only see through a chat window.
And that is the point worth sitting with. As more developers wire Claude, ChatGPT and Copilot into local toolchains via MCP servers, CLI wrappers and the growing pile of "agent" frameworks, the sandboxes those assistants use are no longer hypothetical. They sit on real disks, on real laptops, holding real customer spreadsheets, half-finished contracts, screenshots of dashboards. A malicious dependency that knows the path is a malicious dependency that knows the loot.
OX flagged the package and npm removed it. Download numbers were small (a detail that matters less than it sounds, given how supply-chain attackers tend to seed and reseed under fresh aliases). The GitHub repository receiving the stolen files has also been taken down.
No named victims. No CVE. No vendor patch, because there is nothing for Anthropic to patch — the sandbox behaved exactly as designed, holding the files the user gave it. The failure, if you want to call it that, was the developer who typed npm install mouse5212-super-formatter without asking why a formatter would need network access at all.
So the question the incident leaves on the desk is a quieter one. When the assistant on your screen keeps a folder on your machine, who is auditing the dependencies that can read it?
