npm package report

Is xerxes-ora-neptune-dotenv safe?

The malicious-package record for xerxes-ora-neptune-dotenv covers every version, but the registry still serves 1 release and the record does not name which were malicious. Check the references below before installing any version.

Malicious-package record: every version

CRITICAL

Credential stealer. Added to CyberXYZ 2025-11-12, OSV malicious-package feed (Google / OpenSSF).

// what we observed

This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) designed to automatically generate and publish derivative packages with randomized names to inflate developer reputation scores for tea protocol token rewards. The malicious payload modifies package.json to remove private flags, changes version numbers, generates random Indonesian-themed package names (some variants are also in English), and continuously republishes variants to pollute the npm registry.

Reported by Amazon Inspector via OSV.

mitre ttp: T1056

// versions and what to do

Malicious: all versions

If one of these versions was installed, remove it and treat the credentials, tokens and SSH keys on that machine as exposed: rotate them. Check CI runners and container images that installed it too.

OSV record

// reach

1 direct dependencies

none carry a known advisory

0 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

Checked 2026-10-31 at 03:22 UTC. Updated continuously from NVD, GHSA, OSV and CNA feeds.