Malicious packages named camelotlabs-sdk and four related packages were published to the public npm registry at version 99.0.0 by an attacker using the name madman0619. These packages contain a payload that exfiltrates sensitive credentials and environment files from Cloudflare Workers projects using Upstash Redis and HMAC signing keys. The attack exploits dependency confusion by using an inflated version number to override internal packages. The malicious code runs during installation and sends collected data to a command and control server.