Malicious packages named camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by an actor using the name madman0619. These packages use a dependency confusion attack by leveraging an inflated version number to override internal packages. Upon installation, a preinstall script executes code that collects environment variables, configuration files, and credentials related to Cloudflare Workers projects, Upstash Redis, HMAC signing keys, and other secrets. The stolen data is exfiltrated to a remote command and control server.