[BUG] Can't install `camelcase`, `decamelize` and other camel-related packages (#camelgate)
Problem
> STATUS: > ✅ Cloudflare marked it as resolved: > This issue is now resolved. - 19:42 UTC > ✅ NPM marked it as resolved: > This incident has been resolved. - 19:40 UTC > 👀 NPM is monitoring the situation: > A fix has been implemented and we are monitoring the results. - 17:37 UTC > 👀 Cloudflare disabled the rule and is monitoring the situation: > We have disabled the rule in question, and the rate of false positives is decreasing. We are monitoring. - 17:31 UTC > ✅ Seems to be working again - 17:13:17 UTC GET BACK TO WORK, NERDS! > ✅ NPM fixed: > The issue has been identified and a fix is being implemented. - 17:11 UTC > 🛠️ Cloudflare is fixing: > Identified - Cloudflare has identified an issue with the managed ruleset "Apache Camel - Remote Code Execution - CVE:CVE-2025-29891" which is potentially causing false positives. Customers can disable this rule by setting Action -> Log in the Cloudflare Dashboard. Other WAF rules are unaffected. We are currently working on a fix for this issue. > 👀 NPM is investigating: > We are currently investigating reports of intermittent failures when viewing and installing packages scoped to certain keywords. - 16:40 UTC > 👀 First failure in our CI - 15:49:08 UTC Caused by https://developers.cloudflare.com/waf/change-log/2025-03-11-emergency/ Is there an existing issue for this? - [x] I have searched the existing issues This issue exists in the latest npm version - [x] I am using the latest npm Affected packages registry.
Unverified for your environment
Select your OS to check compatibility.
1 Fix
Solution: [BUG] Can't install `camelcase`, `decamelize` and other camel-related packages (#camelgate)
I'm getting this for a few different ones: - https://registry.npmjs.org/camelcase - https://registry.npmjs.org/camelcase-keys/-/camelcase-keys-6.2.2.tgz - https://registry.npmjs.org/decamelize - https://registry.npmjs.org/camel-case - https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz - https://registry.npmjs.org/camelcase-css As a result, my CI pipeline is failing and I can
Trust Score
6 verifications
- 1
I'm getting this for a few different ones:
- https://registry.npmjs.org/camelcase - https://registry.npmjs.org/camelcase-keys/-/camelcase-keys-6.2.2.tgz - https://registry.npmjs.org/decamelize - https://registry.npmjs.org/camel-case - https://registry.npmjs.org/lodash.camelcase/-/lodash.camelcase-4.3.0.tgz - https://registry.npmjs.org/camelcase-css
- 2
As a result, my CI pipeline is failing and I cannot build/deploy.
As a result, my CI pipeline is failing and I cannot build/deploy.
- 3
First failure was at ~10:55 AM CDT
First failure was at ~10:55 AM CDT
- 4
I can occasionally get the following via my browser, which I think is likely rel
I can occasionally get the following via my browser, which I think is likely related:
Validation
Resolved in npm/cli GitHub issue #8203. Community reactions: 27 upvotes.
Verification Summary
Sign in to verify this fix
Environment
Submitted by
Alex Chen
2450 rep