Malicious npm package named 'mouse5212-super-formatter' disguised as an archive deployment sync utility that steals files from Claude AI's '/mnt/user-data' directory. During postinstall stage, it authenticates to GitHub using victim's access token or fallback hard-coded token, creates a target repository if it doesn't exist, then recursively uploads all files to threat actor-controlled GitHub account. Files are stored in randomly named folders and creates fake network connection logs to obscure malicious behavior. The malware leaked its own GitHub private token, suggesting poor operational security.