MalwarePublished 11 Aug 2026Updated 12 Aug 2026

camelot-ammv2-core (npm) · Malicious Code

Affects camelot-ammv2-coreSource GCVE Database

Malicious package : remove camelot-ammv2-core and rotate any secrets on hosts that installed it.

Data as of 12 Aug 2026, 16:52 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-13772

What to do

Remove camelot-ammv2-core from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmcamelot-ammv2-core	Affected =1.1.0 =1.1.1 =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The camelot-ammv2-core npm package is a malicious typosquatting package impersonating Camelot DEX's AMM v2 core contracts. It contains no legitimate functionality and executes a payload during installation that harvests sensitive environment variables, credential files, and cryptocurrency wallet keys from the installer's system. The stolen data is exfiltrated via HTTPS to an attacker-controlled endpoint. Versions 1.0.0 and 1.1.0 differ in the scope of harvested files and tokens, with 1.1.0 escalating the data theft to include private keys and additional credential files. The package was published by the npm account 'mssjeep843' and is part of a batch of similarly malicious packages targeting DeFi developers. Systems that installed these versions should consider all harvested secrets compromised and rotate them immediately.

Impact

Installation of camelot-ammv2-core versions 1.0.0, 1.1.0, or 1.1.1 results in the compromise of sensitive environment variables, credential files, and cryptocurrency wallet private keys on the installer's system. The attacker gains access to AWS credentials, SSH private keys, Kubernetes and Docker configs, API tokens, and wallet keys, enabling potential unauthorized access to cloud resources, source code repositories, blockchain wallets, and other sensitive infrastructure. The exfiltration occurs silently during package installation, with error handling to avoid detection. Any secrets present on affected systems should be considered compromised, especially wallet private keys and RPC/API tokens if version 1.1.0 or later was installed.

Defensive guidance

The primary mitigation is to immediately identify and uninstall any instances of camelot-ammv2-core versions 1.0.0, 1.1.0, or 1.1.1. All secrets and credentials present on affected systems at the time of installation must be rotated or revoked, prioritizing wallet private keys and RPC/API tokens. Developers should audit their dependency sources carefully to avoid typosquatting packages and use package integrity verification where possible. Monitor for any unauthorized access using compromised credentials and consider additional incident response measures as needed.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Aug 2026, 16:52 UTC

Technical details

References

Community reviews