<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8"><div dir="ltr"></div><div dir="ltr">On Apr 10, 2025, at 13:21, Forrest Aldrich wrote:</div><div dir="ltr"><blockquote type="cite"><br></blockquote></div><blockquote type="cite"><div dir="ltr">My malware checker has identified potential malware (AtomicStealer)
distributed from MacPorts. I'd like to confirm with the community
what else is known:<br>
<br>
<br>
<blockquote>/Applications/MacPorts/tea.app<br>
➜ /Applications cd MacPorts<br>
</blockquote></div></blockquote><br><div>I know that tea is a text editor. </div><div><br></div><div><a href="https://ports.macports.org/port/tea">https://ports.macports.org/port/tea</a></div><div><br></div><div>I am not aware of it containing malware. </div><div><br></div><div>As far as I know, Atomic Stealer is distributed by tricking a user into downloading and installing what looks like a browser update or a cracked commercial application. It seems unlikely that it would appear in an esoteric open source text editor so my initial assumption is that this is a false positive from your malware checker. </div><div><br></div><div>What is your malware checker? Have you contacted its developer?</div><div><br></div></div></body></html>