Malicious code in camelotlabs-utils (npm)

Five packages (`camelotlabs-sdk`, `camelotlabs-core`, `camelotlabs-config`, `camelotlabs-worker`, and `camelotlabs-utils`) were published to the public npm registry at version 99.0.0 by the actor `madman0619` as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated version number causes npm to prefer the public malicious package over any internally-hosted version of the same name. All five packages carry an identical payload designed to exfiltrate credentials from Cloudflare Workers projects using Upstash Redis and HMAC signing keys. On installation the `preinstall` script executes `index.js`, which collects hostname, platform, working directory, and environment variables whose names match patterns for API keys, tokens, secrets, HMAC signing keys, Upstash/Redis credentials, Vercel and Cloudflare environment bindings, and database connection strings. It also reads and exfiltrates `.env`, `.env.production`, `.env.local`, `wrangler.toml`, `wrangler.json`, and `wrangler.jsonc` files from the working directory and its parents. All collected data is sent via HTTP POST to the C2 server at `http://82.221.101.203:9999/exfil`.

Source published

7 May 2026 00:00:00 UTC

Source modified

13 May 2026 08:52:14 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.