The npm package camelot-ammv2-periphery is a malicious package impersonating Camelot DEX's AMM v2 periphery contracts. It contains no legitimate functionality and executes a malicious payload during installation via preinstall and postinstall hooks. The payload harvests sensitive environment variables, configuration files, and cryptocurrency wallet keys, then exfiltrates this data to a remote server. Two versions (1.0.0 and 1.1.0) were published, with 1.1.0 expanding the scope of harvested files and secrets. The package was published by the npm account 'mssjeep843' and is part of a cluster of malicious packages targeting similar credentials. Any environment that installed these versions should consider all harvested secrets compromised and rotate them immediately.