1037 matches found
MAL-2025-148115 Malicious code in spectron-dotenv-safe-titan-lynx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e48c87ef5045bc4ffe85b3fe5f47863ca0f4efdf3a56a18800accf41a3c842 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-141758 Malicious code in dotenv-safe-lint-standard-stream (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96ce93bc5896847055a774b8ee4747daf6ed0538e96b9ffb3a4bcc8c1f03366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-147449 Malicious code in rimraf-dotenv-safe-wasat-hugo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ccf289cbd205a33d2d44a901a7c9891a58d1e2ea2e6bcbdfbbeecc2e82fd0c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Improper Configuration Management
TinyEnv is vulnerable to Improper Configuration Management. The vulnerability is due to the application not requiring the .env file to exist when loading environment variables, which allows an attacker or misconfiguration to cause the application to run with insecure defaults or missing...
Malicious Package
Overview python-dotenv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in python-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2025-32984
Malicious code in python-dotenv npm...
MAL-2025-48037 Malicious code in python-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bf133022adafc8949f152dac2e99730580ca64a570cf0aeae36b7f81f3c1db9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview dotenv-light is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in dotenv-light (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae938c214e61a6e70c595df567e32105d5c5eebb0cd147deae6c5f7fe91c75c5 Any computer that has this package installed or running should be considered...
MAL-2025-47584 Malicious code in dotenv-light (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae938c214e61a6e70c595df567e32105d5c5eebb0cd147deae6c5f7fe91c75c5 Any computer that has this package installed or running should be considered...
Improper Check or Handling of Exceptional Conditions
Overview datahihi1/tiny-env is a simple environment variable loader for PHP applications Affected versions of this package are vulnerable to Improper Check or Handling of Exceptional Conditions due to the loading of environment variables without requiring the .env file to exist. An attacker can...
CVE-2025-58759 TinyEnv: Inline comments not stripped properly in .env values
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters including or comment text...
CVE-2025-58759 TinyEnv: Inline comments not stripped properly in .env values
TinyEnv is an environment variable loader for PHP applications. In versions 1.0.9 and 1.0.10, TinyEnv did not properly strip inline comments inside .env values. This could lead to unexpected behavior or misconfiguration, where variables contain unintended characters including or comment text...
CVE-2025-58758
CVE-2025-58758 affects TinyEnv, a PHP environment-variable loader. Versions 1.0.1, 1.0.2, 1.0.9, and 1.0.10 do not require the .env file to exist when loading variables, enabling the application to run with missing or insecure defaults. The issue has been fixed in version 1.0.11. Mitigation provi...
Malicious code in semantic-release-dotenv-safe-commitlint-node-sass (npm)
The package semantic-release-dotenv-safe-commitlint-node-sass was found to contain malicious code...
Malicious code in dotenv-webdriver-manager-carina-altair (npm)
The package dotenv-webdriver-manager-carina-altair was found to contain malicious code...
Malicious code in dotenv-parse-variables-cluster-mongoose-xanthus (npm)
The package dotenv-parse-variables-cluster-mongoose-xanthus was found to contain malicious code...