1051 matches found
EUVD-2025-204881
Malicious code in dotenv-extend npm...
MAL-2025-192743 Malicious code in dotenv-extend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36b33fa03b9dafefe167d7891f649dc39ac77a18a67a25c44d0d647dd3518e9 The package dotenv-extend was found to contain malicious code. Source: ghsa-malware 7ef0bc2453e5610efd0011a08cecb1021a4d5a38aee276a269ad3185bb40925a...
Malicious Package
Overview dotenv-extend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Storybook manager bundle may expose environment variables during build
On December 11th, the Storybook team received a responsible disclosure alerting them to a potential vulnerability in certain built and published Storybooks. The vulnerability is a bug in how Storybook handles environment variables defined in a .env file, which could, in specific circumstances, le...
CVE-2025-68429 Storybook manager bundle may expose environment variables during build
Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to versions 7.6.21, 8.6.15, 9.1.17, and 10.1.10 relates to Storybook’s handling of environment variables defined in a .env file, which could...
Malicious code in dotenv-intend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b29ae1386b4f6a14de72979eae00fc96b33b8a080975db5c8eb8917d23fdeff The package dotenv-intend was found to contain malicious code. Source: ghsa-malware 64a31dce3bccc8134695abbe65011f655e810a0a28726ce2d60668e3689ab605...
MAL-2025-192290 Malicious code in dotenv-intend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b29ae1386b4f6a14de72979eae00fc96b33b8a080975db5c8eb8917d23fdeff The package dotenv-intend was found to contain malicious code. Source: ghsa-malware 64a31dce3bccc8134695abbe65011f655e810a0a28726ce2d60668e3689ab605...
EUVD-2025-201137
Malicious code in dotenv-intend npm...
Malicious Package
Overview dotenv-intend is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of this package. On...
Malicious code in nightmare-mesosphere-iota-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2277b8efd1d670698357ef4928cfdeebcbaf96d247814a668af92fe7f157f8e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in archaeometry-cordelia-capella-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2c8d6a31e349fd295ea6069c1f1bc56f8eba23734d8405f248f309f202a2e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in sails-dotenv-adonis-antd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa31083ce72f58be06ef61827800200ffc7fb0df078a978047d564620b116b79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178105
Malicious code in library-dotenv-safe-gridsome-singularity npm...
Malicious code in dotenv-hexo-apollo-cryonics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 199267a35ed5937ef5f63c6920324dae39fe64bc54a1dd7c5dc19a3157ede4a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177133
Malicious code in playwright-dotenv-parse-variables-parcel-less npm...
Malicious code in kronos-ichnology-dotenv-safe-seismology (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6c772d9ee172d9d8a4149b89bb7e9d6739711a4032f4fe5a817bbd35ea114c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179255
Malicious code in dotenv-safe-vortex-meissa-webdriverio npm...
EUVD-2025-179259
Malicious code in dotenv-safe-norma-vuetify-paleomagnetism npm...