Malware dev tries to steal Claude users' secrets, writes npm slop, leaks own GitHub private token

A malware developer attempting to steal secrets from users of Anthropic's Claude AI model inadvertently exposed their own GitHub private token while publishing malicious npm packages. The developer's sloppy operational security allowed researchers to trace the attack back to its source, undermining the credential-theft campaign.

MOST POPULAR EVENTS - The Hardware Crunch: How Supply Chain Turbulence Is Forcing a New IT Playbook Infrastructure teams are facing a perfect storm: extended hardware lead times, rising costs driven by AI demand, and accelerated platform timelines. - Overcoming the trade-offs in data sovereignty What does data sovereignty actually mean for your network, which trade-offs are unavoidable? Learn more. - From Prompt to Exploit: How LLMs Are Changing API Attacks Modern applications are API-driven, interconnected, and often over-permissioned, making them an ideal target for AI-assisted attacks. - Architecting the Future: Unlocking Enterprise Data Services for Kubernetes Join us to discover how to eliminate infrastructure silos and establish a standardized, enterprise-grade cloud-native platform. - Catch the Advanced Attacks Microsoft 365 Misses with Behavioral AI Security Microsoft 365 is the backbone of enterprise communication, and its native security filters out the known and the noisy. - How Agents are Reshaping AI Security AI adoption is accelerating and with it comes a new security challenge. - How Agents are Reshaping AI Security AI adoption is accelerating and with it comes a new security challenge. - AI Found the Problem. Now What? AI is transforming the software development lifecycle, helping teams identify and remediate vulnerabilities before they reach production. - Virtual Cyber Recovery Sim Step into the chaos of a live ransomware breach, test your response skills, and team up with other IT and security pros to outsmart cybercriminals - Virtual Cyber Recovery Simulation Ransomware attacks aren’t slowing down, and neither are we. Druva’s hit event, Escape Ransomware, is now fully virtual. AI https://beta.theregister.com/tag/ai - off-Prem Snowflake to burn $6B on AWS Graviton CPUs and AI accelerators Dataware house gambles cloud conveniences, AI accelerated insights will justify the cost. - offbeat FAA grounds SpaceX’s Starship after another launch mishap IPO? More like IP-uh-oh - cyber-crime Malware dev tries to steal Claude users' secrets, writes npm slop, leaks own GitHub private token Script kiddies these days - ai + ml Argonne flexes spare supercompute to build private AI inference service Think ChatDoE - Networks ICANN again intervenes to defend AFRINIC Africa’s regional internet registry and its longtime antagonist are fighting on old and new fronts Infosec https://beta.theregister.com/security - off-Prem Snowflake to burn $6B on AWS Graviton CPUs and AI accelerators Dataware house gambles cloud conveniences, AI accelerated insights will justify the cost. - offbeat FAA grounds SpaceX’s Starship after another launch mishap IPO? More like IP-uh-oh - cyber-crime Malware dev tries to steal Claude users' secrets, writes npm slop, leaks own GitHub private token Script kiddies these days - ai + ml Argonne flexes spare supercompute to build private AI inference service Think ChatDoE - Networks ICANN again intervenes to defend AFRINIC Africa’s regional internet registry and its longtime antagonist are fighting on old and new fronts FOSS https://beta.theregister.com/tag/FOSS - Snowflake to burn $6B on AWS Graviton CPUs and AI accelerators Dataware house gambles cloud conveniences, AI accelerated insights will justify the cost. - FAA grounds SpaceX’s Starship after another launch mishap IPO? More like IP-uh-oh - Malware dev tries to steal Claude users' secrets, writes npm slop, leaks own GitHub private token Script kiddies these days - Argonne flexes spare supercompute to build private AI inference service Think ChatDoE - ICANN again intervenes to defend AFRINIC Africa’s regional internet registry and its longtime antagonist are fighting on old and new fronts - AI hiring algorithms reject Black, Asian job seekers at higher rates Stanford researchers argue need for transparency and independent testing FEATURES https://www.theregister.com/tag/features? gl=1 esekfm ga NzgyNjE4NzEwLjE3NzExNzQ4MjA. ga JXW44Y23NM czE3NzY3NTY3MjIkbzEwNSRnMSR0MTc3Njc1Njg5NCRqOCRsMCRoMA.. - Europe built sovereign clouds to escape US control. Then forgot about the processors - Nobody believes the 'criminals and scumbags' who hacked Canvas really deleted stolen student data - Europe wants out from under US tech – but first it has to find the exits - GNOME may rule Ubuntu Resolute Raccoon, but X.org isn't roadkill yet - OpenClaw, but in containers: Meet NanoClaw - Open source registries don't have enough money to implement basic security - Contain your Windows apps inside Linux Windows - The Linux mid-life crisis that's an opportunity for Tux-led transformation - Too much AI for some, too little for others: Why AMD can't win with investors - How agentic AI can strain modern memory hierarchies