Malicious packages impersonating internal Camelot Labs npm packages were published to the public npm registry with an inflated version number to hijack dependency resolution. These packages execute a payload on installation that collects and exfiltrates sensitive environment variables, configuration files, and credentials related to Cloudflare Workers projects, Upstash Redis, and HMAC signing keys to a remote command and control server.