The Register reports on a malicious npm package aimed at Claude users that imitated AI tooling, pulled in npm-slop dependencies, and accidentally exposed the attacker’s GitHub token, highlighting AI-tooling supply-chain risk in the open source package ecosystem.
Supply chain brain drain: npm attacker foolishly leaks own GitHub private token
The Register reports on a malicious npm package aimed at Claude users that imitated AI tooling, pulled in npm-slop dependencies, and accidentally exposed the attacker's GitHub token, highlighting AI-tooling supply-chain risk in the open source package ecosystem.
Source: The Register