Malicious packages named camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry with an inflated version number 99.0.0. These packages perform a dependency confusion attack targeting Camelot Labs' internal npm packages. Upon installation, a preinstall script executes code that collects sensitive environment variables, configuration files, and credentials related to Cloudflare Workers projects using Upstash Redis and HMAC signing keys, then exfiltrates this data to a remote command and control server.