camelotlabs npm packages (core, config, sdk, worker) published as malware — full machine compromise
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
GitHub's advisory database published four malware advisories on 2026-10-28 covering the npm packages camelotlabs-core, camelotlabs-config, camelotlabs-sdk and camelotlabs-worker. Every published version (= 0) is flagged as embedded malicious code (CWE-506) with no patched versions, meaning the packages were malicious from the start rather than hijacked later. GitHub's standard malware guidance states that any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Downloads of roughly 250-258/month on some packages indicate limited but real exposure. No CVEs are assigned; remediation is removal plus credential rotation and host rebuild.
What to do
- Remove all four camelotlabs-* packages from every machine and CI/CD environment immediately
- Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer
- Rebuild/reimage affected hosts; removal of the package does not guarantee removal of malicious software
- Audit logs and network traffic for signs of exfiltration or attacker access since installation
- Block the packages in dependency policies and check lockfiles for transitive dependencies
Sources
All live incidents on Threat Watch
