Malicious packages named camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by an actor using the name madman0619. These packages use a dependency confusion attack to override internal Camelot Labs packages by leveraging an inflated version number. Upon installation, a preinstall script executes code that collects environment variables, configuration files, and credentials related to Cloudflare Workers projects using Upstash Redis and HMAC signing keys. The stolen data is exfiltrated to a remote command and control server.