camelot-ammv2-core @1.1.1
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13772
Ecosystem
npm
Summary
camelot-ammv2-core@1.1.1 is a typosquat impersonating the Camelot DEX. Its install lifecycle runs index.js, which harvests installer-side secrets — AWS credentials (~/.aws/credentials), SSH private keys (~/.ssh/id_rsa), kube/docker/netrc/npmrc/gcloud/solana/foundry keystores,.env files, and environment variables matching KEY|TOKEN|SECRET|PASS|PRIVATE|MNEMONIC — packs them, and POSTs the collection over HTTPS to webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09. The exfil is dispatched by spawning a detached Node child process with a 60–240 second delay so the request outlives short-lived scanners, and the script bails out when os.hostname() matches sandbox/analysis patterns (scan-, detonation, sandbox, ubuntu-fc-uvm), when the user is scan/nonroot/sandbox, when canarytoken/honey env markers are present, or when a mirror registry is configured. The package name impersonates Camelot to target wallet/DeFi developers whose environments contain RPC endpoints and wallet mnemonics.
Source: amazon-inspector (f2f471dcb89cfe3ee8be8dc3959dd224177993f77975ab2e5f4ec81fd678695b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.