MAL-2025-143814 Malicious code in janus-jekyll-parcel-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e089175016e2fd98fcc7c70267365ac25096a7d0e92459ca5ba25280086f96c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145695 Malicious code in nuxtjs-astro-dotenv-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 361f069c8f34b46d870c8a13f9857e804499b8f943a16c7ba015da58b6adddfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139449 Malicious code in antares-xanadu-delphinus-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c74bc9a61c43f8b3b4c87c88e18264683cf969e9cf7073998f6774e77b9a36b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141785 Malicious code in dotenv-umbra-duplex-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7856ae4344190b8cebd05e3bc90206bc14a97511ec4db990ba37d2fe943a29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143136 Malicious code in halley-dotenv-safe-rehype-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1331a67bea2e24c847db87b08e88619af87131e0e5509a6b8796b8d4eb5d99d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145996 Malicious code in pavo-dotenv-safe-cosmos-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716d370389a73f5f2d8bb1d652817fcd01c99cb04fdd4add1575b54b2c1d2d61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145125 Malicious code in mongodb-dotenv-transform-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e8bc2251b0e9e448ee2693fef77c7fa881c2a5f852b1ebfbb70d8704705c11a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114692

Malicious code in cz-conventional-changelog-dotenv-parse-variables-optimize-css-assets-webpack-plugin-elektra npm...

MAL-2025-143187 Malicious code in hapi-link-dotenv-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d7aff41ffcc47a9ce5cecc9896e60e7457b7563c695aa7759fd139e79d5032c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141765 Malicious code in dotenv-safe-norma-hydra-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 101d7f2d3887b13730933645915b85902ce437343b70cafd0c90a2da7a4e3312 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141715 Malicious code in dotenv-parse-variables-dactyl-hermes-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 553918f29ad698a225d2b077fc60b1d34a4522e23490977aae6619892944fad1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147991 Malicious code in slides-non-blocking-dotenv-safe-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0850f47bc6fffbed41e4a34730cecc0e53621b63abb4a3b3199ba5f61ad97ddf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148068 Malicious code in solis-arcturus-dotenv-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca87b0bfb0cd17d178e3cecbda0ef3048fd1066fb524f365964e3f00cb0dbdc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141777 Malicious code in dotenv-safe-semantic-ui-corvus-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542b8da9f5521fb24d5e53f53645f4fb810e158f42eab400a7d5badcd6f44895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141505 Malicious code in deimos-sass-loader-quark-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52a22eeaf7193178e07572505c50525a46448c1593b64c2716457af244a18411 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141779 Malicious code in dotenv-safe-transport-corvus-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d833eb99411857bbedad036c317ede897b63d5919e73e692817feacf64b3549 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149547 Malicious code in wolf-dotenv-safe-init-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f276f80847acdf6e724ff67d80fb8c48fe61319092838a09349c533b099d4e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Improper Configuration Management

TinyEnv is vulnerable to Improper Configuration Management. The vulnerability is due to the application not requiring the .env file to exist when loading environment variables, which allows an attacker or misconfiguration to cause the application to run with insecure defaults or missing...

EUVD-2025-32984

Malicious code in python-dotenv npm...

MAL-2025-48037 Malicious code in python-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...