Malicious code in camelot-ammv2-core (npm)
camelot-ammv2-core is a malicious npm package impersonating Camelot DEX's AMM v2 core contracts. Versions 1.0.0 and 1.1.0 execute install-time payloads that harvest environment variables, credential files, SSH keys, and cloud configuration from affected machines and exfiltrate them via HTTPS.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed camelot-ammv2-core versions 1.0.0 or 1.1.0 during the publication window; credentials and secrets harvested from affected machines.
- Ecosystems
- Attack vectors
- Affected entities
- camelot-ammv2-core · 1.0.0, 1.1.0
camelot-ammv2-core is a typosquatting/impersonation attack targeting developers working with Camelot DEX. The package contains no legitimate functionality—only a package.json and a malicious install-time payload (index.js) that executes via preinstall and postinstall hooks.
Version 1.0.0 harvests environment variables matching patterns for secrets (KEY, TOKEN, SECRET, PASS, PRIVATE, MNEMONIC, RPC, AWS, GITHUB, NPM, KUBE, VAULT, AUTH, PGP, GPG, SEED, WALLET), reads ~/.npmrc and ~/.gitconfig, and lists directories containing SSH, Foundry, Hardhat, and GCP credentials. It also collects hostname, username, working directory, and platform information. All collected data is exfiltrated via HTTPS POST to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09.
Version 1.1.0, published approximately 2.5 hours after 1.0.0, expanded the attack to read full file contents (up to 4000 bytes) from additional credential locations including .aws/credentials, .aws/config, SSH private keys, Kubernetes config, Docker config, .netrc, .pgpass, .pypirc, .git-credentials, and GCP credential files. Both versions suppress errors to avoid alerting users during installation.
Indicators of compromise
- Packages
- camelot-ammv2-core
- Domains
- webhook.site
Remediation
- Immediately uninstall camelot-ammv2-core from all development machines and CI/CD environments.
- Rotate all credentials, API keys, SSH keys, and secrets that may have been exposed (environment variables, AWS credentials, GitHub tokens, NPM tokens, Kubernetes configs, GCP service accounts, etc.).
- Review npm audit logs and package-lock.json files to identify when and where the malicious package was installed.
- Scan affected machines for any persistence mechanisms or secondary payloads left by the malicious install scripts.
- If using legitimate Camelot DEX contracts, verify the correct package name and source before reinstalling.
- Enable npm package integrity verification and consider using private registries or package allowlists to prevent similar attacks.
Sources
- GitHub Advisory GHSA-j6vj-qx8g-mv2c · GitHub Advisory Database
Cite this entry
"Malicious code in camelot-ammv2-core (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 12, 2026; last updated August 12, 2026. https://supplychainattack.org/incident/malicious-code-in-camelot-ammv2-core-npm-09ahrf
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting