AI-coded npm infostealer leaks private GitHub token
Ox Security researchers discovered an AI-generated npm package that steals local files from Claude users and uploads them to GitHub. The malware's AI-written code accidentally exposed its own hard-coded private GitHub token, allowing researchers to trace the stolen data.
The barrier to writing malware has dropped to zero, but so has the operational security of the people generating it. The package posed as an archive sync utility to steal files and target Claude users. It achieved 676 downloads before the hard-coded GitHub token exposed the threat actor's repository. Ox Security labeled this new class of low-effort, low-skill attacks as "Malware-Slop". Expect package registries to see a surge of poorly secured, AI-generated malware from unskilled actors.
DISCOVERED
12d ago
2026-05-28
PUBLISHED
12d ago
2026-05-28
RELEVANCE
AUTHOR
pcgamer
