camelot-ammv2-periphery (npm) · Malicious Code
Affects camelot-ammv2-peripherySource GCVE Database
Malicious package : remove camelot-ammv2-periphery and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:51 UTC
Malicious package
Published to npm · OSV MAL-2026-13773
What to do
Remove camelot-ammv2-periphery from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmcamelot-ammv2-periphery | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package camelot-ammv2-periphery is a malicious package impersonating Camelot DEX's AMM v2 periphery contracts. It contains no legitimate functionality and executes a malicious payload during installation via preinstall and postinstall hooks. The payload harvests sensitive environment variables, configuration files, and cryptocurrency wallet keys, then exfiltrates this data to a remote server. Two versions (1.0.0 and 1.1.0) were published, with 1.1.0 expanding the scope of harvested files and secrets. The package was published by the npm account 'mssjeep843' and is part of a cluster of malicious packages targeting similar credentials. Any environment that installed these versions should consider all harvested secrets compromised and rotate them immediately.
References
- npmjs.com/package/camelot-ammv2-periphery (opens in a new tab)
- o3.security/blog/crypto-defi-npm-supply-chain-attack-npmrc-exfiltration (opens in a new tab)
- npmjs.com/package/camelot-ammv2-periphery/v/1.1.0 (opens in a new tab)
- npmjs.com/package/camelot-ammv2-periphery/v/1.1.1 (opens in a new tab)
- npmjs.com/package/camelot-ammv2-periphery/v/1.0.0 (opens in a new tab)