camelot-ammv2-core@1.0.0
Malicious code in camelot-ammv2-core (npm)
Analysis
camelot-ammv2-core@1.0.0 runs a credential-harvesting script in both its preinstall and postinstall hooks (node index.js). The script enumerates all environment variables whose names match KEY/TOKEN/SECRET/PASS/PRIVATE/MNEMONIC/RPC/AWS/GITHUB/NPM/KUBE/VAULT/AUTH/PGP/GPG/SEED/WALLET, reads the installer's ~/.npmrc and ~/.gitconfig, and lists the contents of ~/.ssh, ~/.foundry/keystores, ~/.config/hardhat, and ~/.config/gcloud. It then POSTs all collected data as JSON to hxxps://webhook[.]site/326b0891-2093-4800-a4c1-686ce3e07b09. Errors are silently swallowed so the install never fails. The package impersonates the Camelot AMM protocol to harvest wallet keystores and credentials.
- analyzed by
- Leitwacht
- first seen
- Aug 11, 2026, 06:08 AM
- analyzed
- Aug 11, 2026, 06:08 AM
Related advisories
- move-bcs-codec@1.0.0
- python-bitcoinlib@1.0.2
- simple-date-formatter-new-6@1.0.0
- simple-date-formatter-new-3@1.0.0
- simple-date-formatter-util-13@1.0.0
- simple-date-formatter-util-11@1.0.0
- simple-date-formatter-util-10@1.0.0
- simple-date-formatter-util-9@1.0.0
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.