{"id":"MAL-2026-3640","summary":"Malicious code in camelotlabs-config (npm)","details":"Five packages (`camelotlabs-sdk`, `camelotlabs-core`, `camelotlabs-config`, `camelotlabs-worker`, and `camelotlabs-utils`) were published to the public npm registry at version 99.0.0 by the actor `madman0619` as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated version number causes npm to prefer the public malicious package over any internally-hosted version of the same name. All five packages carry an identical payload designed to exfiltrate credentials from Cloudflare Workers projects using Upstash Redis and HMAC signing keys.\n\nOn installation the `preinstall` script executes `index.js`, which collects hostname, platform, working directory, and environment variables whose names match patterns for API keys, tokens, secrets, HMAC signing keys, Upstash/Redis credentials, Vercel and Cloudflare environment bindings, and database connection strings. It also reads and exfiltrates `.env`, `.env.production`, `.env.local`, `wrangler.toml`, `wrangler.json`, and `wrangler.jsonc` files from the working directory and its parents. All collected data is sent via HTTP POST to the C2 server at `http://82.221.101.203:9999/exfil`.","modified":"2026-05-13T08:48:32.689958Z","published":"2026-05-07T00:00:00Z","database_specific":{"malicious-packages-origins":null},"affected":[{"package":{"name":"camelotlabs-config","ecosystem":"npm","purl":"pkg:npm/camelotlabs-config"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/camelotlabs-config/MAL-2026-3640.json"}}],"schema_version":"1.7.5","credits":[{"name":"SafeDep","contact":["https://safedep.io"],"type":"FINDER"}]}