camelot-ammv2-periphery @1.1.1

Summary

The package impersonates the Camelot AMM v2 periphery contracts but ships only a ~3KB Node stealer (index.js) that runs via preinstall/postinstall lifecycle hooks. On install, index.js reads well-known installer secret files (~/.aws/credentials, ~/.aws/config, ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.npmrc, ~/.pypirc, ~/.gitconfig, ~/.git-credentials, gcloud/solana/anchor/sui/foundry keystores, and.env* files in cwd) and enumerates process.env, selecting variables whose names match /KEY|TOKEN|SECRET|PASS|PRIVATE|MNEMONIC|RPC|AWS|GITHUB|NPM|.../i. The harvested payload is POSTed to https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09 from a detached child node process (spawn(process.execPath,['-e',src],{detached:true,stdio:'ignore'}); ch.unref()) after a randomized 60–240 second delay to outlive the install window. Execution is gated by anti-analysis checks that bail out on hostnames matching scan-/detonation/sandbox/ubuntu-fc-uvm, users scan/nonroot/sandbox, env markers honey/canarytokens/spoonfed, and mirror registries like npmmirror. No Solidity or AMM code is present; the package name and description are a lure targeting Camelot DEX integrators who hold wallet keys and RPC credentials.

Source: amazon-inspector (03a1781a084e6fad5552392169f445098b2c6c3ae5f776d47eca23269eabce73)