Supply Chain Spotlight: Analyzing the mouse5212-super-formatter npm Package

Supply Chain Spotlight: Analyzing the mouse5212-super-formatter npm Package

Just caught wind of a concerning report from OX Security regarding a malicious npm package specifically targeting Anthropic's Claude AI workflows. The package, mouse5212-super-formatter, is a textbook typosquatting attempt designed to exfiltrate data from the /mnt/user-data directory.

This is a targeted supply chain attack. The malware specifically looks for files generated by Claude AI tools. If your dev teams are using AI assistants locally or integrating them into CI/CD pipelines without strict sandboxing, this could be a major data leak vector.

Detection & Remediation

If you are managing JavaScript environments, you should immediately audit your package-lock. and node_modules. Since there isn't a CVE assigned yet, we have to rely on package name reputation.

You can use a quick bash command to scan your environments for this specific package name:

find . -name "package-lock." -exec grep -l "mouse5212-super-formatter" {} \;

Additionally, I recommend checking for any network activity from node processes attempting to connect to unknown external IPs, as the malware attempts to upload the stolen files.

The Discussion

We are seeing a shift from generic stealers to AI-specific data pilfering. How are you all handling AI tooling in your dev environments? Are you running them in isolated containers or VMs, or just letting them run on host machines?