LWA-2026-10952 confirmed malware

camelot-ammv2-core@1.0.0

Malicious code in camelot-ammv2-core (npm)

T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1082 · System Information DiscoveryT1552.001 · Credentials In FilesT1552.004 · Private KeysT1041 · Exfiltration Over C2 ChannelT1071.001 · Web Protocols

Analysis

camelot-ammv2-core@1.0.0 runs a credential-harvesting script in both its preinstall and postinstall hooks (node index.js). The script enumerates all environment variables whose names match KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/RPC/AWS/GITHUB/NPM/KUBE/VAULT/AUTH/PGP/GPG/SEED/WALLET, reads the installer's ~/.npmrc and ~/.gitconfig, and lists the contents of ~/.ssh, ~/.foundry/keystores, ~/.config/hardhat, and ~/.config/gcloud. It then POSTs all collected data as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. Errors are silently swallowed so the install never fails. The package impersonates the Camelot AMM protocol to harvest wallet keystores and credentials.

analyzed by
Leitwacht
first seen
Aug 11, 2026, 06:08 AM
analyzed
Aug 11, 2026, 06:08 AM

Related advisories

browse all confirmed advisories →

Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.